feat(entries): encrypt template at rest, guided tour, import fixes, cleanup

Batched session work sharing app.js / index.html / Entries.pas, so it can't
split cleanly without interactive hunk staging.

- feat: encrypt `template` metadata at rest (template_enc/iv, added to
  ENCRYPTED_META_FIELDS). withEncryptedMeta skips an absent template key so
  partial re-ships (add-tag, move-to-folder) don't wipe it via LHasTemplate.
  Cleartext column kept as migration fallback. +3 unit tests.
- feat: first-run guided tour ("How it works") — spotlight + bubble, no GIFs,
  re-launchable from Settings, seen-flag in DPAPI prefs.
- fix(import): preserve original created_at on restore (was stamped to import
  time); restore entry icons on overwrite (PUT ignores icon_b64).
- fix(settings): correct clipboard-privacy copy (already excluded from Win+V);
  PIN text 4-6 -> 4-12; reorder Set-PIN above unlock-method; move tray/startup
  toggles to General; dedicated backup-password button + warning status; tab icons.
- chore: remove dead legacy monolith (app-legacy.js, index-legacy.html,
  style-legacy.css) + unused passkeyBtn stub.
- docs: full-source review (CODE_AUDIT 6b), template + favorite/pinned notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

css/style.css

@@ -2207,6 +2207,29 @@ body[data-editor-position="center"]:has(#settingsPanel.is-open)::before {
 .settings-tab:hover { background: var(--bg-elev-2); }
 .settings-tab.is-active { color: var(--accent-fg); background: var(--accent); border-color: var(--accent); }
 .slideover-field.is-tab-hidden { display: none; }
+/* Guided tour (spotlight + bubble). Backdrop blocks app clicks; the spot's
+   huge box-shadow is the dimmer (no separate overlay needed). */
+.tour-backdrop { position: fixed; inset: 0; z-index: 300; }
+.tour-spot {
+    position: fixed; z-index: 301; pointer-events: none; border-radius: 8px;
+    border: 2px solid var(--accent);
+    box-shadow: 0 0 0 9999px rgba(0, 0, 0, .6);
+    transition: top .2s ease, left .2s ease, width .2s ease, height .2s ease;
+}
+.tour-bubble {
+    position: fixed; z-index: 302; max-width: 300px;
+    background: var(--bg-elev-2, var(--bg-2)); color: var(--text);
+    border: 1px solid var(--border); border-radius: 10px;
+    padding: 14px 16px; box-shadow: 0 8px 30px rgba(0, 0, 0, .45);
+}
+.tour-bubble-title { font-weight: 700; font-size: 14px; margin-bottom: 4px; }
+.tour-bubble-body { font-size: 12px; color: var(--text-dim); line-height: 1.5; }
+.tour-bubble-foot {
+    display: flex; align-items: center; justify-content: space-between;
+    gap: 12px; margin-top: 12px;
+}
+.tour-bubble-count { font-size: 11px; color: var(--text-faint); }
+.tour-bubble-btns { display: flex; gap: 6px; }
 /* Hidden section + per-row + no-results banner driven by JS. */
 .slideover-field.is-search-hidden,
 .setting-row.is-search-hidden { display: none; }