feat(entries): encrypt template at rest, guided tour, import fixes, cleanup

Batched session work sharing app.js / index.html / Entries.pas, so it can't
split cleanly without interactive hunk staging.

- feat: encrypt `template` metadata at rest (template_enc/iv, added to
  ENCRYPTED_META_FIELDS). withEncryptedMeta skips an absent template key so
  partial re-ships (add-tag, move-to-folder) don't wipe it via LHasTemplate.
  Cleartext column kept as migration fallback. +3 unit tests.
- feat: first-run guided tour ("How it works") — spotlight + bubble, no GIFs,
  re-launchable from Settings, seen-flag in DPAPI prefs.
- fix(import): preserve original created_at on restore (was stamped to import
  time); restore entry icons on overwrite (PUT ignores icon_b64).
- fix(settings): correct clipboard-privacy copy (already excluded from Win+V);
  PIN text 4-6 -> 4-12; reorder Set-PIN above unlock-method; move tray/startup
  toggles to General; dedicated backup-password button + warning status; tab icons.
- chore: remove dead legacy monolith (app-legacy.js, index-legacy.html,
  style-legacy.css) + unused passkeyBtn stub.
- docs: full-source review (CODE_AUDIT 6b), template + favorite/pinned notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Auth.pas

@@ -1044,6 +1044,7 @@ begin
             '  site_enc = :senc, site_iv = :siv, ' +
             '  title_enc = :tenc, title_iv = :tiv2, ' +
             '  tags_enc = :genc, tags_iv = :giv, ' +
+            '  template_enc = :tplenc, template_iv = :tpliv, ' +
             '  updated_at = CURRENT_TIMESTAMP ' +
             'WHERE id = :id AND user_id = :uid';
 
@@ -1065,6 +1066,8 @@ begin
             var LTIv  := LEntry.GetValue<string>('title_iv', '');
             var LGEnc := LEntry.GetValue<string>('tags_enc', '');
             var LGIv  := LEntry.GetValue<string>('tags_iv', '');
+            var LTplEnc := LEntry.GetValue<string>('template_enc', '');
+            var LTplIv  := LEntry.GetValue<string>('template_iv', '');
             if (LEntryId <= 0) or (LEncPwd = '') or (LIv = '') then
               raise Exception.CreateFmt('Invalid entry payload at index %d', [I]);
 
@@ -1110,6 +1113,12 @@ begin
             else               LQ.ParamByName('genc').Value := LGEnc;
             if LGIv = '' then LQ.ParamByName('giv').Clear
             else              LQ.ParamByName('giv').Value := LGIv;
+            LQ.ParamByName('tplenc').DataType := ftMemo;
+            LQ.ParamByName('tpliv').DataType  := ftMemo;
+            if LTplEnc = '' then LQ.ParamByName('tplenc').Clear
+            else                 LQ.ParamByName('tplenc').Value := LTplEnc;
+            if LTplIv = '' then LQ.ParamByName('tpliv').Clear
+            else                LQ.ParamByName('tpliv').Value := LTplIv;
             LQ.ExecSQL;
           end;
           // Password history is encrypted with the OLD vault key — we