feat(sync): enforce strong sync password (§1.4/§4)

The sync password is the only thing protecting the remote snapshot, but it
accepted 8 chars. Gate raised to 12+ chars AND computeStrength >= 50 (reused
from app.js — no zxcvbn dependency).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

js/app.sync.js

@@ -124,13 +124,16 @@ async function syncSetEncPwdFlow() {
             title:    'Set sync password',
             message:  'Use the SAME password on every device that syncs with this remote. ' +
                       'Stored DPAPI-protected on this device only — never transmitted.',
-            placeholder: 'At least 8 characters',
+            placeholder: '12+ chars, mix letters/digits/symbols',
             password: true,
             okText:   'Save',
             error:    err,
         });
         if (!v) return;
-        if (v.length >= 8) {
+        // This password is the ONLY thing protecting the remote snapshot
+        // (§1.4) — enforce a real minimum. computeStrength reused from app.js
+        // (no zxcvbn dep). >=12 + one complexity category clears 50.
+        if (v.length >= 12 && computeStrength(v) >= 50) {
             Bridge.setPref(SYNC_PREFS.encPwd, v);
             const pwdStatus = document.getElementById('syncPwdStatus');
             if (pwdStatus) pwdStatus.textContent = 'Set.';
@@ -139,7 +142,7 @@ async function syncSetEncPwdFlow() {
         }
         n++;
         if (n >= 5) return toast('Too many invalid attempts', 'error');
-        err = 'Use at least 8 characters (attempt ' + n + ' / 5).';
+        err = 'Too weak — use 12+ chars mixing letters, digits and symbols (attempt ' + n + ' / 5).';
     }
 }