feat: website favicons + vault health dashboard

Favicons
- PM.Favicon (new): THTTPClient/WinHTTP proxy to icons.duckduckgo.com.
  Native Windows TLS — no OpenSSL DLLs to ship (Indy would fail
  silently without them). 5 s timeout, max 3 redirects, 64 KB cap,
  magic-byte MIME sniffing.
- DB: vault_entries.icon_b64 TEXT (idempotent migration).
- Endpoints: POST /entries/{id}/icon stores a cached data URI without
  forcing a full PUT (which would re-encrypt the password). DELETE
  /entries/icons/all purges the cache.
- Bridge cmd://favicon/fetch?host=X&reqId=Y runs in an anonymous thread
  so the up-to-5 s HTTP GET doesn't block the main thread; result
  shipped back via Bridge.onFaviconResult(reqId, host, dataUri).
- Hostname validated on both sides (JS faviconHost + Delphi
  NormalizeHost) so brand labels like "Gitea" never leak upstream.
- Settings: opt-in "Fetch website icons" toggle (synced), three explicit
  actions (Fetch missing / Re-fetch all / Clear cache) that bypass the
  toggle — manual user actions always work.
- Entry card avatar shows <img> when cached, falls back to initials.
  onerror handler recovers silently from a corrupt data URI.

Vault health
- New sidebar Tools → "Vault health" view. Four category cards:
  Weak (strength < 50), Reused (same plaintext on ≥ 2 entries), Old
  (updated_at > 365d), Pwned (HIBP cache).
- Score 0-100 with colour band (Good/Fair/At risk/Critical).
- One-shot computation cached per session (healthCache), invalidated
  on lockVault, entry save, and the explicit "Recompute" button.
- "Fix" button on each item opens the slideover for the affected
  entry, unmasks the password, focuses it, and pulses the dice button
  — full context preserved, user decides how to fix.
- Click handler stopPropagation prevents the document-level
  "click outside slideover" listener from closing the panel that
  we just opened in the same click event.

Fixes
- openSlideover typo (lowercase O) → openSlideOver across all call
  sites. Was silently breaking the Authenticator card click and the
  Vault health Fix button.
- W1050 WideChar warning in PM.Favicon — replaced set-membership
  with explicit Ord-style range comparisons.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

css/style.css

@@ -837,6 +837,14 @@ input[type="range"]::-webkit-slider-thumb {
     font-weight: 600; font-size: 14px;
     color: var(--text);
     flex-shrink: 0;
+    overflow: hidden;
+}
+.entry-avatar-img {
+    width: 100%; height: 100%;
+    object-fit: contain;
+    padding: 4px;
+    box-sizing: border-box;
+    image-rendering: -webkit-optimize-contrast; /* sharper 16x16 icons */
 }
 .entry-title { flex: 1; min-width: 0; display: flex; flex-direction: column; }
 .entry-title b {
@@ -1102,6 +1110,137 @@ input[type="range"]::-webkit-slider-thumb {
 }
 .auth-card-bar.is-warning { background: #f59e0b; }
 
+/* ---- Vault health dashboard ----------------------------- */
+.entry-grid.is-health {
+    display: flex;
+    flex-direction: column;
+    gap: 16px;
+}
+.health-loading {
+    color: var(--text-dim);
+    text-align: center;
+    padding: 40px;
+    font-size: 14px;
+}
+.health-header {
+    display: flex; align-items: center; gap: 20px;
+    background: var(--bg-elev);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    padding: 20px;
+}
+.health-score {
+    width: 110px; height: 110px;
+    border-radius: 50%;
+    display: flex; flex-direction: column;
+    align-items: center; justify-content: center;
+    flex-shrink: 0;
+    border: 4px solid var(--accent);
+    background: var(--bg);
+}
+.health-score.is-ok     { border-color: #10b981; color: #10b981; }
+.health-score.is-fair   { border-color: var(--accent); color: var(--accent); }
+.health-score.is-warn   { border-color: #f59e0b; color: #f59e0b; }
+.health-score.is-danger { border-color: #ef4444; color: #ef4444; }
+.health-score-num {
+    font-size: 36px; font-weight: 700;
+    font-family: 'JetBrains Mono', ui-monospace, monospace;
+}
+.health-score-lbl {
+    font-size: 11px; font-weight: 600;
+    text-transform: uppercase; letter-spacing: 0.5px;
+    margin-top: 2px;
+}
+.health-intro { flex: 1; }
+.health-intro h3 { margin: 0 0 6px; font-size: 16px; }
+.health-intro p {
+    margin: 0 0 10px;
+    color: var(--text-dim);
+    font-size: 13px;
+    line-height: 1.5;
+}
+.health-card {
+    background: var(--bg-elev);
+    border: 1px solid var(--border);
+    border-radius: var(--radius);
+    padding: 16px 18px;
+}
+.health-card-head {
+    display: flex; align-items: center; gap: 10px;
+    margin-bottom: 6px;
+}
+.health-card-head h4 {
+    margin: 0;
+    font-size: 14px;
+    font-weight: 600;
+}
+.health-badge {
+    min-width: 22px;
+    padding: 2px 8px;
+    border-radius: 11px;
+    background: var(--accent);
+    color: white;
+    font-size: 11px;
+    font-weight: 700;
+    text-align: center;
+}
+.health-badge.is-empty {
+    background: var(--bg);
+    color: var(--text-dim);
+}
+.health-hint {
+    margin: 0 0 10px;
+    font-size: 12px;
+    color: var(--text-dim);
+    line-height: 1.4;
+}
+.health-empty {
+    margin: 0;
+    font-size: 12px;
+    color: var(--text-faint);
+    font-style: italic;
+}
+.health-list {
+    list-style: none;
+    margin: 0;
+    padding: 0;
+    display: flex; flex-direction: column;
+    gap: 4px;
+}
+.health-item {
+    display: flex; align-items: center; gap: 8px;
+    padding: 6px 10px;
+    background: var(--bg);
+    border-radius: var(--radius-sm);
+    font-size: 13px;
+}
+.health-item-label {
+    flex: 1;
+    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+    color: var(--text);
+}
+.health-more {
+    margin: 6px 0 0;
+    color: var(--text-faint);
+    font-size: 11px;
+    font-style: italic;
+    text-align: center;
+}
+.btn-xs {
+    font-size: 11px;
+    padding: 3px 10px;
+}
+
+/* Brief attention pulse on the slideover generator button after Fix */
+@keyframes attentionPulse {
+    0%, 100% { box-shadow: 0 0 0 0 var(--accent); }
+    50%      { box-shadow: 0 0 0 6px transparent; }
+}
+.icon-btn.is-pulse {
+    animation: attentionPulse 0.7s ease-out 3;
+    border-radius: var(--radius-sm);
+}
+
 /* ---- 10. SLIDE-OVER -------------------------------------- */
 
 .slideover {