Phase 5: CSRF, bcrypt hashing, audit logging, export re-auth

- Add CSRF token per session, validated on all state-changing requests (POST/PUT/DELETE)
- Upgrade password hashing from PBKDF2 to bcrypt; auto-upgrade old hashes on login
- Add audit_log table tracking all security events (login, export, delete, etc.)
- Add /reauth endpoint requiring master password before export
- Client-side: re-auth modal before export, X-CSRF-Token header on mutations

index.html

@@ -166,7 +166,7 @@
                 <div style="text-align:center;color:var(--text2);padding:2rem;grid-column:1/-1">📭 No entries</div>
             </div>
             <div style="margin-top:.6rem;text-align:right">
-                <button class="btn btn-outline btn-sm" onclick="exportPasswords()">📤 Export</button>
+                <button class="btn btn-outline btn-sm" onclick="showExportModal()">📤 Export</button>
             </div>
         </div>
     </div>