feat(bridge): auto-lock on sleep/hibernate + fix UPSERT syntax

Sleep/hibernate handling
========================
Adds WM_POWERBROADCAST / PBT_APMSUSPEND handling alongside the existing
WTS_SESSION_LOCK detection. Closing a laptop lid often suspends the
system without firing a session lock, leaving the decrypted vault in
memory until resume — this fixes that.

Implementation note: WM_POWERBROADCAST is normally only delivered to
top-level windows, and Windows can silently skip hidden utility windows.
PowerRegisterSuspendResumeNotification (user32, Win 8+) forces delivery
to our specific HWND regardless. Loaded dynamically via GetProcAddress
so older Windows degrades gracefully (WTS lock still works).

The suspend handler reuses OnSystemLock — semantically the same event
from the user's perspective ("I'm leaving the machine"). Calls
lockVault() in JS via ExecuteJavaScript.

RateLimit fix (related: lockout feature from previous commit)
=============================================================
The UPSERT (INSERT ... ON CONFLICT DO UPDATE) in RecordFailedAccountAttempt
errored with "near ON: syntax error" — either the bundled SQLite version
or FireDAC's parameter preprocessor doesn't handle UPSERT correctly.
Replaced with portable UPDATE-then-INSERT (safe under our DB.Lock).

Also:
 - datetime modifier ("+60 seconds") built in Delphi via Format() rather
   than SQL-side concatenation ('+' || :sec || ' seconds'), which FireDAC
   was mangling on some configs.
 - GetAccountLockoutRemaining rewritten with julianday() (the SQLite
   idiom for date arithmetic) instead of strftime('%s'). Cleaner, NULL-safe.

delphi-backend/Source/PM.Bridge.pas

@@ -61,6 +61,7 @@ type
     FIconOwned: Boolean;   // true = we must call DestroyIcon on FIconHandle
     FIconHandle: HICON;
     FNid: TNotifyIconData;
+    FPowerNotify: THandle; // registration handle from PowerRegisterSuspendResumeNotification
     FSecureClipboard: TSecureClipboard;
     FBalloonShown: Boolean;
     FOnSystemLock: TProc;
@@ -116,6 +117,19 @@ const
   WTS_SESSION_LOCK        = 7;
   NOTIFY_FOR_THIS_SESSION = 0;
 
+// Power management broadcast — sent to all top-level windows when the
+// system is about to sleep / hibernate or has just resumed. No explicit
+// registration needed (unlike WTS).
+// PBT_APMSUSPEND ($04) : "system is suspending operation" — fires once,
+//   right before sleep/hibernate. This is our lock trigger.
+// PBT_APMRESUMEAUTOMATIC ($12) : system resumed (we don't need to act).
+// PBT_APMRESUMESUSPEND ($07) : system resumed with user interaction.
+const
+  WM_POWERBROADCAST       = $0218;
+  PBT_APMSUSPEND          = $0004;
+  PBT_APMRESUMEAUTOMATIC  = $0012;
+  PBT_APMRESUMESUSPEND    = $0007;
+
 // Dynamic WTS function pointers — wtsapi32.dll is not guaranteed on all
 // Windows SKUs (e.g. minimal Server Core without Session Services), so
 // we load it at runtime and tolerate absence gracefully.
@@ -135,6 +149,31 @@ begin
   _WTSUnregister := GetProcAddress(_WtsLib, 'WTSUnRegisterSessionNotification');
 end;
 
+// Power notification registration (Windows 8+). Forces delivery of
+// WM_POWERBROADCAST to a specific HWND, including non-top-level / hidden
+// utility windows that Windows might otherwise skip. Exported from user32.
+const
+  DEVICE_NOTIFY_WINDOW_HANDLE = 0;
+
+var
+  _PowerRegister  : function(Flags: DWORD; Recipient: THandle;
+    out RegistrationHandle: THandle): DWORD; stdcall = nil;
+  _PowerUnregister: function(RegistrationHandle: THandle): DWORD; stdcall = nil;
+  _PowerApiLoaded : Boolean = False;
+
+procedure LoadPowerApi;
+var
+  LLib: HMODULE;
+begin
+  if _PowerApiLoaded then Exit;
+  _PowerApiLoaded := True;
+  // Functions live in user32.dll despite the "Power" prefix.
+  LLib := GetModuleHandle('user32.dll');
+  if LLib = 0 then Exit;
+  _PowerRegister   := GetProcAddress(LLib, 'PowerRegisterSuspendResumeNotification');
+  _PowerUnregister := GetProcAddress(LLib, 'PowerUnregisterSuspendResumeNotification');
+end;
+
 // =============================================================================
 //  TSecureClipboard
 // =============================================================================
@@ -238,10 +277,22 @@ begin
   LoadWtsApi;
   if Assigned(_WTSRegister) then
     _WTSRegister(FMsgWindow, NOTIFY_FOR_THIS_SESSION);
+
+  // Sleep/hibernate detection. Forces WM_POWERBROADCAST delivery to our
+  // message-only window even if Windows would otherwise skip it. On
+  // Windows < 8 this fails silently — only modern systems support this
+  // API, but they're also the ones that have aggressive sleep behavior.
+  FPowerNotify := 0;
+  LoadPowerApi;
+  if Assigned(_PowerRegister) then
+    _PowerRegister(DEVICE_NOTIFY_WINDOW_HANDLE, FMsgWindow, FPowerNotify);
 end;
 
 destructor TPMBridge.Destroy;
 begin
+  if (FPowerNotify <> 0) and Assigned(_PowerUnregister) then
+    _PowerUnregister(FPowerNotify);
+
   if Assigned(_WTSUnregister) then
     _WTSUnregister(FMsgWindow);
 
@@ -479,6 +530,19 @@ begin
   begin
     if AMsg.WParam = WTS_SESSION_LOCK then
       if Assigned(FOnSystemLock) then FOnSystemLock();
+  end
+
+  else if AMsg.Msg = WM_POWERBROADCAST then
+  begin
+    // Sleep/hibernate fires PBT_APMSUSPEND. Treat it identically to a
+    // session lock: the user is leaving the machine unattended, so the
+    // vault must be locked. Without this, closing a laptop lid (which
+    // doesn't always trigger WTS_SESSION_LOCK if the system goes straight
+    // to sleep) would leave the decrypted state in memory until resume.
+    // PBT_APMSUSPEND is delivered SYNCHRONOUSLY before the system
+    // suspends — fast handler required (no UI prompts, no network).
+    if AMsg.WParam = PBT_APMSUSPEND then
+      if Assigned(FOnSystemLock) then FOnSystemLock();
   end;
 
   AMsg.Result := DefWindowProc(FMsgWindow, AMsg.Msg, AMsg.WParam, AMsg.LParam);