feat(auth): change master password with full vault re-encryption

Adds the canonical PM feature: let the user pick a new master password
and have every entry transparently re-encrypted under the new key,
without ever exposing plaintext to the server.

Backend endpoint: POST /change-master-password
==============================================
Body:
  {
    currentMasterPassword,   verified against current stored hash
    newMasterPassword,       basis for the new hash + new client key
    newSalt,                 64-char hex, client-generated
    entries: [{ id, encrypted_password, iv,
                totp_secret?, totp_iv? }, ...]
  }

Flow:
  1. Authenticate + RequireCSRF (caller already logged in).
  2. RejectIfAccountLocked — pw change is brute-forceable through a
     hijacked session, so it respects the same per-account lockout as
     /login.
  3. Verify currentMasterPassword against the stored hash. Branches on
     hash_algo to handle both legacy 'pbkdf2' and current 'pbkdf2-sha256'.
     Wrong pw → RecordFailedAccountAttempt + audit + 401.
  4. Compute new auth hash = SHA256(PBKDF2(new_pw, new_salt, 600k)),
     always using the current scheme (migration baked in).
  5. ATOMIC transaction:
       UPDATE users SET password_hash, salt, kdf_iterations, hash_algo
       UPDATE vault_entries SET encrypted_password, iv, totp_secret, totp_iv
       (per entry)
     Any failure → rollback, user stays on the old config.
  6. DeleteAllUserSessions — every OTHER session is invalidated so a
     leaked old token can't keep working past the rotation. The current
     caller's session stays valid.
  7. ClearAccountLockout + audit_log entry.
  8. Returns { message, salt, kdfIterations }.

Client
======
New modal in index.html (#changeMasterModal) with three password
fields (current / new / confirm) + inline error display. Added a
"Change master password" button in the Settings panel → Account
section. Escape-key handler routes through it like the other modals.

doChangeMasterPassword():
  1. Local validation: all fields filled, new ≥ 8 chars, new == confirm,
     new ≠ current. Fast failure beats a round trip.
  2. randomHexSalt() → 32 secure random bytes, hex-encoded.
  3. Derive newKey = PBKDF2(new_pw, new_salt, 600k).
  4. Walk state.entries: decrypt password + (optional) TOTP under the
     current key, re-encrypt under newKey with fresh random IVs.
     One decrypt failure aborts the whole change — better than partial
     commit.
  5. POST to /change-master-password.
  6. On success: swap state.salt + state.cryptoKey, persistCryptoKey,
     update sessionStorage, refresh cached ciphertexts in state.entries,
     close modal, toast.
  7. On 401 / 429 / generic error: show inline error in the modal so
     the user can fix and retry without re-typing everything.

Threat model notes
==================
 - The current session token stays valid because the new server hash
   only invalidates OTHER sessions. Self-logout would be needlessly
   disruptive (user already proved knowledge of both pws).
 - Server still sees the old + new master pws transiently in /change-
   master-password. Same trade-off as /login — eliminating it requires
   redesigning to send pre-computed verifiers (SRP-style), tracked
   separately.
 - The salt rotates with the password — best-practice against any
   precomputed dictionary attack tied to the previous salt.

js/app.js

@@ -2409,6 +2409,151 @@ function closeReauth(ok) {
     }
 }
 
+// ============================================================
+// CHANGE MASTER PASSWORD
+// ============================================================
+//
+// Two-step flow:
+//   1. Modal collects current pw + new pw (×2) + validates locally.
+//   2. Client re-encrypts every entry under the new key (derived from
+//      new pw + freshly-generated salt) and sends the whole payload to
+//      /change-master-password. Server verifies current pw, then commits
+//      user row + all entry ciphertexts in one transaction.
+// On success: state.salt + state.cryptoKey are swapped, the user stays
+// logged in (current session preserved), all OTHER sessions invalidated.
+
+// 64-char hex salt — matches the format the server expects and the shape
+// produced by Delphi RandomHex(32). Crypto-secure RNG.
+function randomHexSalt() {
+    const bytes = crypto.getRandomValues(new Uint8Array(32));
+    let hex = '';
+    for (const b of bytes) hex += b.toString(16).padStart(2, '0');
+    return hex;
+}
+
+function openChangeMasterModal() {
+    $('#cmCurrentPwd').value = '';
+    $('#cmNewPwd').value     = '';
+    $('#cmConfirmPwd').value = '';
+    const errEl = $('#cmError');
+    if (errEl) { errEl.textContent = ''; errEl.style.display = 'none'; }
+    $('#changeMasterModal').classList.remove('is-hidden');
+    setTimeout(() => $('#cmCurrentPwd').focus(), 50);
+}
+
+function closeChangeMasterModal() {
+    $('#changeMasterModal').classList.add('is-hidden');
+}
+
+function showCmError(msg) {
+    const el = $('#cmError');
+    if (!el) return;
+    el.textContent = msg;
+    el.style.display = '';
+}
+
+async function doChangeMasterPassword() {
+    const curPwd  = $('#cmCurrentPwd').value;
+    const newPwd  = $('#cmNewPwd').value;
+    const confPwd = $('#cmConfirmPwd').value;
+
+    // Local validation. Server enforces these too, but failing fast saves
+    // a round trip + leaves the modal open so the user can fix and retry.
+    if (!curPwd || !newPwd || !confPwd) return showCmError('All fields are required');
+    if (newPwd.length < 8)              return showCmError('New password must be at least 8 characters');
+    if (newPwd !== confPwd)             return showCmError('New password and confirmation do not match');
+    if (newPwd === curPwd)              return showCmError('New password must differ from the current one');
+
+    // Disable the confirm button so a double-click doesn't fire two
+    // re-encryption passes in parallel.
+    const btn = $('#cmConfirmBtn');
+    if (btn) btn.disabled = true;
+    try {
+        // Step 1: generate the new salt and derive the new AES key.
+        const newSalt = randomHexSalt();
+        const newKey  = await deriveKey(newPwd, newSalt, 600000);
+
+        // Step 2: re-encrypt every entry's password AND every entry's TOTP
+        // secret (if present) under the new key. The current state.cryptoKey
+        // still decrypts the existing ciphertext.
+        const encrypted = [];
+        for (const e of state.entries) {
+            const plain = await decryptPwd(e.encrypted_password, e.iv);
+            if (plain === '[ERROR]') {
+                throw new Error('Could not decrypt entry id=' + e.id);
+            }
+            // Swap the key around encryptPwd so it picks up the new one.
+            const oldKey = state.cryptoKey;
+            state.cryptoKey = newKey;
+            try {
+                const re = await encryptPwd(plain);
+                let totpEnc = '', totpIv = '';
+                if (e.totp_secret && e.totp_iv) {
+                    state.cryptoKey = oldKey;
+                    const plainTotp = await decryptTotpSecret(e.totp_secret, e.totp_iv);
+                    state.cryptoKey = newKey;
+                    if (plainTotp !== '[ERROR]') {
+                        const t = await encryptPwd(plainTotp);
+                        totpEnc = t.encrypted;
+                        totpIv  = t.iv;
+                    }
+                }
+                encrypted.push({
+                    id:                 e.id,
+                    encrypted_password: re.encrypted,
+                    iv:                 re.iv,
+                    totp_secret:        totpEnc,
+                    totp_iv:            totpIv,
+                });
+            } finally {
+                state.cryptoKey = oldKey; // restore until server confirms
+            }
+        }
+
+        // Step 3: send the atomic request. Server verifies the current pw,
+        // updates the user row, swaps every entry's ciphertext, returns
+        // the new salt + iter count.
+        const r = await api('/change-master-password', {
+            method: 'POST',
+            headers: authHeaders({ 'Content-Type': 'application/json' }),
+            body: JSON.stringify({
+                currentMasterPassword: curPwd,
+                newMasterPassword:     newPwd,
+                newSalt:               newSalt,
+                entries:               encrypted,
+            }),
+        });
+
+        // Step 4: server committed → switch the in-memory key & salt, refresh
+        // the cached ciphertexts, persist for F5 survival.
+        state.salt      = r.salt || newSalt;
+        state.cryptoKey = newKey;
+        await persistCryptoKey();
+        sessionStorage.setItem('salt', state.salt);
+        for (let i = 0; i < state.entries.length; i++) {
+            const nc = encrypted[i];
+            state.entries[i].encrypted_password = nc.encrypted_password;
+            state.entries[i].iv                 = nc.iv;
+            state.entries[i].totp_secret        = nc.totp_secret || null;
+            state.entries[i].totp_iv            = nc.totp_iv     || null;
+        }
+
+        closeChangeMasterModal();
+        toast('Master password changed · other sessions signed out');
+    } catch (err) {
+        if (err.status === 401) {
+            showCmError('Current password is incorrect');
+        } else if (err.status === 429 && err.body && err.body.retry_after) {
+            showCmError('Account locked, try again in ' +
+                Math.ceil(err.body.retry_after / 60) + ' min');
+        } else {
+            showCmError('Failed: ' + (err.message || 'unknown error'));
+        }
+    } finally {
+        if (btn) btn.disabled = false;
+    }
+}
+
 // ============================================================
 // ENCRYPTED EXPORT CONTAINER
 // ============================================================
@@ -3184,6 +3329,13 @@ async function init() {
     });
     $('#exportBtn').addEventListener('click', doExport);
     $('#importBtn').addEventListener('click', doImport);
+    $('#changeMasterBtn').addEventListener('click', openChangeMasterModal);
+    $('#changeMasterForm').addEventListener('submit', e => {
+        e.preventDefault();
+        doChangeMasterPassword();
+    });
+    $$('#changeMasterModal [data-close]').forEach(b =>
+        b.addEventListener('click', closeChangeMasterModal));
 
     // Re-auth modal
     $('#reauthForm').addEventListener('submit', e => { e.preventDefault(); closeReauth(true); });
@@ -3211,6 +3363,10 @@ async function init() {
                 closeConfirm(false);
                 return;
             }
+            if (!$('#changeMasterModal').classList.contains('is-hidden')) {
+                closeChangeMasterModal();
+                return;
+            }
             closePalette();
             closeSlideOver();
             closeEntryModal();