refactor(js): extract quick-search overlay cluster from app.js (§3.1)

Eighth slice. Quick search wasn't contiguous — its functions sat on both
sides of the cheatsheet and password-history modals (lines 725-1104). Rather
than a fiddly non-contiguous cut, the whole overlay cluster is extracted as
one byte-identical block: js/app.overlays.js (quick search + cheatsheet +
password history). Pure declarations, no top-level side effects → loads
before app.js; all state/api/Bridge/render/decryptPwd refs resolve via shared
global scope at call time.

- Byte-for-byte identical; syntax OK on all nine app parts; 62/62 tests green.
- index.html + BuildAssets whitelist + harness APP_PARTS updated.

app.js: 11936 → 9170 lines (8 modules extracted, ~2770 lines). Load order:
argon2 → crypto → totp → favicon → import → backup → health → overlays →
app → sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

index.html

@@ -1198,6 +1198,7 @@
 <script src="js/app.import.js"></script>
 <script src="js/app.backup.js"></script>
 <script src="js/app.health.js"></script>
+<script src="js/app.overlays.js"></script>
 <script src="js/app.js"></script>
 <script src="js/app.sync.js"></script>
 </body>