Add hover reveal, drag-to-folder, generator presets, favorites

- Inline password reveal on hover (controlled by showView setting, replaces eye button)
- Drag an entry card onto a folder chip to move it (no modal needed)
- Generator presets: Strong 16, Strong 20, Paranoid 32 buttons
- Favorites: star toggle button per entry, entries sort to top
- Add favorite column to vault_entries, toggle endpoint, star UI in all views
- Gold border/background for favorited entries

api.php

@@ -88,6 +88,7 @@ try { $db->exec("ALTER TABLE vault_entries ADD COLUMN deleted_at DATETIME"); } c
 try { $db->exec("ALTER TABLE users DROP COLUMN encryption_key"); } catch (Exception $e) {}
 try { $db->exec("ALTER TABLE users ADD COLUMN hash_algo TEXT DEFAULT 'pbkdf2'"); } catch (Exception $e) {}
 try { $db->exec("ALTER TABLE sessions ADD COLUMN csrf_token TEXT"); } catch (Exception $e) {}
+try { $db->exec("ALTER TABLE vault_entries ADD COLUMN favorite INTEGER DEFAULT 0"); } catch (Exception $e) {}
 
 $db->exec("DELETE FROM sessions WHERE expires_at < datetime('now')");
 $db->exec("DELETE FROM login_attempts WHERE attempted_at < datetime('now', '-15 minutes')");
@@ -321,6 +322,7 @@ try {
                     'folder' => $r['folder'] ?? 'All',
                     'deleted' => $r['deleted'],
                     'deleted_at' => $r['deleted_at'],
+                    'favorite' => (int)($r['favorite'] ?? 0),
                     'created_at' => $r['created_at'],
                     'updated_at' => $r['updated_at']
                 ];
@@ -405,6 +407,18 @@ try {
             echo json_encode(['message'=>'Restored']);
             break;
 
+        // Favorite toggle
+        case (preg_match('/^\/entries\/(\d+)\/favorite$/', $path, $m) && $method === 'POST'):
+            $auth = authenticate($db);
+            requireCSRF($db, $auth['userId']);
+            $st = $db->prepare('UPDATE vault_entries SET favorite = CASE WHEN favorite=1 THEN 0 ELSE 1 END WHERE id=:id AND user_id=:uid');
+            $st->bindValue(':id', $m[1], SQLITE3_INTEGER);
+            $st->bindValue(':uid', $auth['userId'], SQLITE3_INTEGER);
+            $st->execute();
+            logAudit($db, $auth['userId'], 'toggle_favorite');
+            echo json_encode(['message'=>'Toggled']);
+            break;
+
         case ($path === '/logout' && $method === 'POST'):
             $auth = authenticate($db);
             requireCSRF($db, $auth['userId']);