feat(entries): encrypt template at rest, guided tour, import fixes, cleanup

Batched session work sharing app.js / index.html / Entries.pas, so it can't
split cleanly without interactive hunk staging.

- feat: encrypt `template` metadata at rest (template_enc/iv, added to
  ENCRYPTED_META_FIELDS). withEncryptedMeta skips an absent template key so
  partial re-ships (add-tag, move-to-folder) don't wipe it via LHasTemplate.
  Cleartext column kept as migration fallback. +3 unit tests.
- feat: first-run guided tour ("How it works") — spotlight + bubble, no GIFs,
  re-launchable from Settings, seen-flag in DPAPI prefs.
- fix(import): preserve original created_at on restore (was stamped to import
  time); restore entry icons on overwrite (PUT ignores icon_b64).
- fix(settings): correct clipboard-privacy copy (already excluded from Win+V);
  PIN text 4-6 -> 4-12; reorder Set-PIN above unlock-method; move tray/startup
  toggles to General; dedicated backup-password button + warning status; tab icons.
- chore: remove dead legacy monolith (app-legacy.js, index-legacy.html,
  style-legacy.css) + unused passkeyBtn stub.
- docs: full-source review (CODE_AUDIT 6b), template + favorite/pinned notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

delphi-backend/Source/PM.Database.pas

@@ -372,6 +372,11 @@ begin
   AddColumnIfMissing('vault_entries', 'title_iv',          'TEXT');
   AddColumnIfMissing('vault_entries', 'tags_enc',          'TEXT');
   AddColumnIfMissing('vault_entries', 'tags_iv',           'TEXT');
+  // template encrypted at rest too (§1.3) — hides the entry category
+  // (credit-card / ssh-key…) from a stolen DB. Cleartext `template` column
+  // below stays as migration fallback until every row carries template_enc.
+  AddColumnIfMissing('vault_entries', 'template_enc',       'TEXT');
+  AddColumnIfMissing('vault_entries', 'template_iv',        'TEXT');
   // Cached favicon as a base64 data URI (e.g. "data:image/png;base64,...").
   // Fetched on demand by the Delphi favicon proxy when the user opts in.
   // NULL = no icon cached → JS falls back to the first-letter avatar.