refactor(js): extract quick-search overlay cluster from app.js (§3.1)

Eighth slice. Quick search wasn't contiguous — its functions sat on both
sides of the cheatsheet and password-history modals (lines 725-1104). Rather
than a fiddly non-contiguous cut, the whole overlay cluster is extracted as
one byte-identical block: js/app.overlays.js (quick search + cheatsheet +
password history). Pure declarations, no top-level side effects → loads
before app.js; all state/api/Bridge/render/decryptPwd refs resolve via shared
global scope at call time.

- Byte-for-byte identical; syntax OK on all nine app parts; 62/62 tests green.
- index.html + BuildAssets whitelist + harness APP_PARTS updated.

app.js: 11936 → 9170 lines (8 modules extracted, ~2770 lines). Load order:
argon2 → crypto → totp → favicon → import → backup → health → overlays →
app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -38,6 +38,7 @@ js/app.favicon.js (favicon fetch/cache + faviconHost — extrait §3.1)
 js/app.import.js  (export container + import CSV/JSON — extrait §3.1)
 js/app.backup.js  (auto-backup planifié — extrait §3.1)
 js/app.health.js  (vault health dashboard — extrait §3.1)
+js/app.overlays.js (quick search + cheatsheet + password history — extrait §3.1)
 js/app.js         (le reste : state, Bridge, api, UI…)
 js/app.sync.js    (WebDAV + merge — extrait §3.1, APRÈS app.js car
                    effet de bord top-level `Bridge.onWebdavResult = …`)
@@ -109,6 +110,7 @@ seule `api()` est stubbée).
 | Import/export frontend (CSV/JSON parse, export container) — extrait §3.1 | `js/app.import.js` |
 | Auto-backup frontend (planifié, chiffré) — extrait §3.1 | `js/app.backup.js` |
 | Vault health dashboard — extrait §3.1 | `js/app.health.js` |
+| Quick search + cheatsheet + history modal — extrait §3.1 | `js/app.overlays.js` |
 | Sync frontend (WebDAV, snapshot, merge) — extrait §3.1 | `js/app.sync.js` |
 | Argon2id vendé (bundle `@noble/hashes`, IIFE) | `js/argon2.js` |
 | HTML racine | `index.html` |