From e23a78dda764e797ab884265a5de1dba9538977b Mon Sep 17 00:00:00 2001
From: r-zakarya <82443831+r-zakarya@users.noreply.github.com>
Date: Fri, 26 Jun 2026 21:20:07 +0100
Subject: [PATCH] feat: entry templates + tag autocomplete + slideover push +
 robustness bundle
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Entry templates: new vault_entries.template column drives a typed
  sub-kind ('credit-card', 'ssh-key', 'server', 'recovery-codes'). Card
  + table label off the template, badge reads "credit card" instead of
  "note". Templates seed kind=note (no site/password required), use
  custom_fields with optional dropdown options (brand, month/year,
  protocol). Round-tripped across export/import/duplicate/master-pw
  rotation, preserved by partial PUTs via a HasTemplate flag.
- Custom fields: support per-field `options[]` rendering as <select>
  (card brand, expiry MM/YYYY, SSH/server protocol).
- Tags: existing-tag autocomplete dropdown under the chip input,
  filtered against what's already selected.
- Search history: per-query X for individual delete + 1s debounced
  commit (no Enter required).
- Slideover: clicking outside closes again (drag-selection respected
  via mousedown origin tracker), Esc closes, X closes. App shell is
  pushed left by 420px when the panel is open so the table / pagination
  / sort / search stay visible and interactive.
- Export/import: JSON now round-trips custom_fields, attachments
  (decrypted to base64, re-encrypted under current key on restore),
  icon_b64, and template. CSV warning lists what's not included.
- Auto-backup: same payload shape as user-driven export.
- Notes: import (JSON + CSV) accepts kind=note with empty site,
  preserves title/template/custom_fields. CSV parser detects kind/
  template columns.
- Bulk-import response returns `ids[]` parallel to input so the
  client can map back to new entry IDs (drives attachment restore).
- Move-to-folder bugs fixed: moveEntryToFolder, batchMoveToFolder,
  addTag, batchAddTag were all silently wiping TOTP / custom_fields
  / kind / template via partial PUT. Now re-ship full payload.
- Master-pw rotation: server mints a fresh session token + csrf so
  the very next request after rotation no longer ESessionRejects.
  Client adopts the new pair. Attachments are re-encrypted client-side
  during rotation (GET old → decrypt with old key → encrypt with new
  → PUT). New endpoints: GET /attachments/all, PUT /attachments/:id.
- Duplicate: carries icon_b64 + template + attachments to the copy.
- HandleCreateEntry: accepts icon_b64.
- FireDAC param fix: all blob/icon/custom_fields params use ftMemo +
  .Value assignment so SQLite TEXT no longer truncates to 4000 chars
  (deepseek's 200+ KB favicon was being wiped on lock/unlock).
- HandleSetEntryIcon cap: 262144 → 524288 chars (base64 of a 256 KB
  raw fetch overflows the old cap, fails silently in saveEntryIcon).
- Native save dialog: surfaces server errors instead of swallowing.
- Modals: reauth (export) + backup-password prompt support inline
  error display, retry up to 5 attempts, then hard-stop.
- Keyboard cursor (j/k): bootstraps to current page, auto-paginates
  when the cursor crosses a page boundary, Enter opens slideover.
- Slideover focuses Title on edit-open so j/k → Enter → type Just
  Works.
- TOTP tool: Esc closes the modal.
- App version + launch mode (auto/manual): exposed via bridge,
  surfaced in Settings → Account. Autostart launches suppress the
  first-time tray balloon.
- Passkey button hidden (Delphi backend stubs WebAuthn at 501).
- TEST_PLAN.md captured for regression coverage.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 CLAUDE.md                                     |   20 +-
 TEST_PLAN.md                                  |  102 ++
 css/style.css                                 |  136 +-
 .../Handlers/PM.Handler.Attachments.pas       |  121 ++
 delphi-backend/Handlers/PM.Handler.Auth.pas   |   24 +-
 .../Handlers/PM.Handler.Entries.pas           |  203 ++-
 delphi-backend/Source/PM.Bridge.pas           |    5 +
 delphi-backend/Source/PM.Database.pas         |    8 +
 delphi-backend/Source/PM.Favicon.pas          |    4 +-
 delphi-backend/Source/PM.QuickUnlock.pas      |   34 +-
 delphi-backend/UMainForm.pas                  |   31 +-
 delphi-backend/assets/assets.res              |  Bin 483728 -> 534460 bytes
 index.html                                    |   29 +-
 js/app.js                                     | 1238 +++++++++++++++--
 14 files changed, 1752 insertions(+), 203 deletions(-)
 create mode 100644 TEST_PLAN.md

diff --git a/CLAUDE.md b/CLAUDE.md
index e7b8ff3..cb64b65 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -358,7 +358,9 @@ Résout le cas "j'ai ajouté un mot de passe avec tri A-Z, où se loge-t-il ?"
 Une `vault_entries` row porte **plusieurs blobs chiffrés indépendants** :
 `encrypted_password/iv`, `totp_secret/totp_iv`, `custom_fields/custom_fields_iv`,
 plus le champ-icône `icon_b64` et les méta non chiffrées (`site, title,
-username, folder, tags, kind`).
+username, folder, tags, kind, template`). `template` est le sous-type
+(ex: `credit-card`, `ssh-key`, `server`, `recovery-codes`) qui drive le
+label de card/table — vide pour login/note génériques.
 
 Quand tu ajoutes un nouveau champ (chiffré ou non), il faut **toujours**
 mettre à jour ces 6 endroits sous peine de perdre la donnée silencieusement
@@ -375,7 +377,13 @@ sur certaines actions :
    `for (const e of state.entries)` re-chiffre chaque blob et push dans
    `encrypted[]`. Manquer un champ chiffré = donnée perdue.
 6. **`duplicateEntry`** (js/app.js) — copier le blob chiffré tel quel
-   (même vault key, pas besoin de re-chiffrer)
+   (même vault key, pas besoin de re-chiffrer). Pour `icon_b64` :
+   inclure dans le body POST. Pour attachments : boucle séparée après
+   create qui GET source attachments + POST sur le nouveau id.
+7. **`moveEntryToFolder`** (js/app.js) — PUT partiel sans ces champs =
+   wipe silencieux (TOTP perdu, custom_fields perdus, et notes rejetées
+   en 400 "Site required" parce que `kind` default à 'login'). Re-ship
+   le payload complet, seul `folder` change.
 
 Bonus utile (pas critique) : `soDirtyCheck` doit comparer le nouveau
 champ, et `openSlideOver` doit le déchiffrer et l'exposer via `soState`.
@@ -403,9 +411,11 @@ client-side with the vault key.
   mime, size are stored in cleartext (leaked metadata) so the listing
   doesn't have to decrypt all rows on slideover-open.
 - **Cap** : 5 MB raw client-side check, ~10 MB base64 server-side.
-- **Master pw rotation** : attachments are NOT re-encrypted on rotation
-  → they become inaccessible. Known limitation, document for users who
-  rotate master pw (rotate before adding heavy attachments).
+- **Master pw rotation** : attachments ARE re-encrypted client-side after
+  the entries flip. Loop fetches each blob via `GET /attachments/:id`,
+  decrypts with old key, re-encrypts with new key, PUTs the new blob via
+  `PUT /attachments/:id`. Best-effort: a failure on one attachment shows
+  a warning but doesn't undo the rotation.
 - **UI** : `soAttachmentsField(entryId)` rendered in slideover (existing
   entries only, never on new). Upload via hidden file input + paperclip
   button. Download reuses `Bridge.saveFile` (native Save As dialog).
diff --git a/TEST_PLAN.md b/TEST_PLAN.md
new file mode 100644
index 0000000..5c97d46
--- /dev/null
+++ b/TEST_PLAN.md
@@ -0,0 +1,102 @@
+# Test plan — commit `fa7ea19` (native save + auto-backup + folder customization + attachments + UX bundle)
+
+Coche au fur et à mesure. Les **🔥 regression** sont les bugs déjà vus à
+re-vérifier explicitement.
+
+## 0. Setup
+- [✅] `delphi-backend\assets\BuildAssets.cmd` + F9 (sinon embedded ≠ disque)
+- [✅] Lance avec `config.txt` présent (debug panel + log)
+- [✅] Crée 2 users de test ou utilise vault existant non critique
+
+## 1. Native Save As
+- [✅] Settings → Export encrypted JSON → maître pw OK → backup pw → boîte "Enregistrer sous" Windows native (pas le popup Téléchargements Edge)
+- [✅] Export CSV → idem natif
+- [✅] Annule la dialog → toast "save cancelled" attendu, pas d'erreur silencieuse
+
+## 2. Auto-backup
+- [✅] Settings → Auto-backup → toggle on → prompt pwd (< 6 chars rejeté)
+- [✅] "Choose…" → folder Windows valide → path s'affiche
+- [✅] "Backup now" → fichier `vault-autobackup-yyyymmdd-HHmmss.json` créé dans le folder
+- [✅] Lance plusieurs "Backup now" (interval = 1 jour) → fichiers s'accumulent → après N+1, le plus vieux est purgé (vérifier `keep` retention)
+- [✅] Toggle off → re-on → prompt pwd à nouveau (confirme que le pwd est effacé)
+- [ ] Restart app, unlock → 5s plus tard, si `interval` passé, backup auto silencieux (regarde le folder)
+- [✅] **Restore** : install fresh → import "Encrypted JSON" → choisis un backup → tape le pwd → entries restaurées intactes
+
+## 3. Folder customization
+- [✅] Sidebar → + Folders → modal s'ouvre → name+color+icon → Create → folder visible avec custom icon + color
+- [✅] Hover sur folder → pencil apparaît → click → modal pré-rempli → change icon → Save → re-render OK
+- [✅] **Folder chip sur card** : crée entry dans "Banking" → la chip sous le pwd montre l'icône shield + couleur (pas le default folder gris) 🔥
+- [✅] Drag-reorder : grab folder → drag au-dessus d'un autre → ligne d'insertion cyan visible (above/below selon mouse Y) → drop → ordre changé persisté (refresh app)
+
+## 4. Drag entries vers folders 🔥
+- [✅] Drag d'une LOGIN entry → folder → toast "Moved to X" → entry change de folder
+- [✅] Drag d'une NOTE entry → folder → toast "Moved to X" (régression v1, doit marcher maintenant)
+- [✅] Drag d'une entry avec **TOTP configuré** → folder → ouvre l'entry après → **TOTP toujours là** (pas wipé)
+- [✅] Drag d'une entry avec **custom_fields** → folder → custom_fields préservés
+- [✅] Drag d'une entry vers son propre folder → no-op (pas d'erreur)
+
+## 5. Recently used
+- [✅] Vue vide au start (rien jamais touché) → "No entries"
+- [✅] Copy password d'une entry → attends 2s → sidebar "Recently used" → entry visible en tête
+- [✅] Ouvre une entry (slideover) → idem
+- [✅] Copy 5 entries rapidement → max 10 visibles, ordre = plus récent d'abord
+- [✅] Lock vault + unlock → liste rechargée du serveur (accessed_at persiste)
+
+## 6. Encrypted attachments
+- [✅] Crée entry, sauve, ré-ouvre → section "Attachments" visible (pas sur new entry)
+- [✅] "Attach file" → file picker → upload PDF/PNG < 5 MB → toast OK → liste affiche filename+size+mime
+- [✅] Upload fichier > 5 MB → toast erreur "File too large"
+- [✅] Download → boîte Save As → fichier décrypté identique à l'original (hash check si paranoid)
+- [✅] Delete → confirm modal → row disparaît
+- [✅] Crée 2nd attachment, supprime entry parent → vérifier que les rows entry_attachments sont aussi delete (CASCADE FK) via `sqlite vault.db "select count(*) from entry_attachments"`
+- [✅] Master pw rotation avec attachments → toast "Re-encrypting N attachment(s)…" puis "Attachments re-encrypted" → download d'un attachment **après rotation** réussit (re-chiffré client-side dans le flux change-master)
+
+## 7. Password expiry
+- [✅] Settings → Flag aged → 90 days
+- [✅] Backdoor : `sqlite vault.db "UPDATE vault_entries SET password_changed_at = '2024-01-01' WHERE id = X"` → recharge → badge "Aged" visible sur la card de X
+- [✅] Edit l'entry, change le password, Save → badge disparaît (password_changed_at bumpé)
+- [✅] Edit l'entry, change **uniquement le title**, Save → badge **toujours là** (password_changed_at pas bumpé — le CASE SQL filtre)
+- [✅] Filters dropdown → "Aged password" → liste filtrée
+
+## 8. Print recovery code
+- [✅] Settings → Recovery → Generate (ou regenerate) → modal avec code → bouton "Print"
+- [✅] Click Print → preview Edge → vérifie : code 32px monospace, account name, date, instructions 3 étapes, page A4 propre (le reste de l'app caché)
+- [✅] Annule la print preview → app revient normalement (cleanup du #printRecoveryArea)
+
+## 9. Audit log
+- [✅] Sidebar → Tools → Audit log → table visible avec actions chronologiques
+- [✅] Fais une action (add entry, copy pwd) → refresh audit log → nouvelle ligne en tête
+- [✅] Search dans audit log → filtre marche
+
+## 10. Pinned entries
+- [✅] Sur n'importe quelle card, click pushpin → toast "Pinned to top" → entry remonte en tête de la liste
+- [✅] Re-click → toast "Unpinned" → entry retrouve sa place dans le sort courant
+- [✅] Change le sort (name asc → date desc) → entries pinned restent en tête, le tri interne s'applique aux deux groupes
+- [✅] Compact mode (Settings → Compact actions) → kebab menu contient "Pin to top" / "Unpin"
+- [✅] Pin 3 entries, lock vault, unlock → les 3 sont toujours en tête (persist serveur)
+- [ ] Master pw rotation → pinned préservé (pas wipé)
+- [✅] Duplicate d'une entry pinned → la copie est **non pinned** (comportement voulu)
+
+## 11. Search history
+- [✅] Tape une recherche, attends 1s sans bouger → recherche ajoutée à l'historique (pas besoin d'Enter)
+- [✅] Vide la searchbar → focus → dropdown "Recent searches" avec les dernières
+- [✅] Click sur un item → re-filtre et bump en tête
+- [✅] X individuel sur un item → suppression isolée
+- [✅] "Clear" → vide tout l'historique
+- [✅] Dropdown disparaît au click hors searchbar / Escape / blur      => un petit probleme > focus search bar > dropdown search affiché > clique à nouveau search (focus non changé) dropdown non affiché  
+
+## 12. Regressions générales 🔥
+- [✅] Quick unlock encore fonctionnel après update
+- [✅] Master password rotation OK + entries déchiffrables après
+- [✅] Autofill (Ctrl+Shift+L/P) toujours OK
+- [ ] Recovery code redeem fonctionne (sur compte test)
+- [✅] Lock vault → unlock → toutes entries présentes
+- [ ] Trash → restore → entry revient avec tous ses champs (kind, custom_fields, TOTP)
+
+## 13. Console / log scrutiny
+- [ ] Ouvre debug panel → execute scénarios ci-dessus → log Delphi sans `FAILED`/`ERROR` non attendu
+- [ ] Si tu peux ouvrir console JS (DevTools désactivé en prod, faut hack — sinon skip) → pas d'erreur JS rouge pendant les flows
+
+---
+
+**Ordre conseillé** : 0 → 4 → 6 → 7 → 1 → 2 → 3 → 5 → 8 → 9 → 10 → 11 → 12 → 13. Le drag entries (#4) est le plus à risque (régression confirmée hier), le faire tôt + à fond.
diff --git a/css/style.css b/css/style.css
index d47bc55..f503d41 100644
--- a/css/style.css
+++ b/css/style.css
@@ -304,6 +304,35 @@ input[type="range"]::-webkit-slider-thumb {
     box-shadow: 0 0 0 3px var(--accent-soft);
     background: var(--bg);
 }
+/* Existing-tag autocomplete dropdown anchored under the chip-input. */
+.tag-suggest {
+    position: absolute;
+    top: 100%; left: 0; right: 0;
+    margin-top: 4px;
+    background: var(--bg-elev);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    box-shadow: var(--shadow-lg);
+    z-index: 60;
+    overflow: hidden;
+    max-height: 240px;
+    overflow-y: auto;
+}
+.tag-suggest.is-hidden { display: none; }
+.tag-suggest-item {
+    display: flex; align-items: center; gap: 8px;
+    width: 100%;
+    padding: 7px 10px;
+    background: transparent;
+    border: none;
+    color: var(--text);
+    font-size: 13px;
+    text-align: left;
+    cursor: pointer;
+}
+.tag-suggest-item:hover { background: var(--bg-elev-2); }
+.tag-suggest-item svg { width: 12px; height: 12px; color: var(--text-faint); }
+
 .chip-input input {
     flex: 1;
     min-width: 80px;
@@ -605,6 +634,81 @@ input[type="range"]::-webkit-slider-thumb {
     opacity: 1;
 }
 .search kbd { position: absolute; right: 8px; }
+
+/* Search history dropdown */
+.search-history {
+    position: absolute;
+    top: calc(100% + 4px);
+    left: 0;
+    right: 0;
+    background: var(--bg-elev);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    box-shadow: var(--shadow-lg);
+    z-index: 50;
+    overflow: hidden;
+}
+.search-history.is-hidden { display: none; }
+.search-history-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 6px 10px;
+    border-bottom: 1px solid var(--border-soft);
+    font-size: 11px;
+    color: var(--text-faint);
+    text-transform: uppercase;
+    letter-spacing: 0.4px;
+}
+.search-history-clear {
+    background: transparent;
+    border: none;
+    color: var(--text-dim);
+    font-size: 11px;
+    cursor: pointer;
+    padding: 2px 6px;
+    border-radius: 3px;
+}
+.search-history-clear:hover { color: var(--danger); background: var(--danger-soft); }
+.search-history-row {
+    display: flex;
+    align-items: stretch;
+}
+.search-history-row:hover { background: var(--bg-elev-2); }
+.search-history-item {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    flex: 1;
+    min-width: 0;
+    padding: 8px 12px;
+    background: transparent;
+    border: none;
+    color: var(--text);
+    font-size: 13px;
+    cursor: pointer;
+    text-align: left;
+}
+.search-history-item svg { width: 13px; height: 13px; color: var(--text-faint); }
+.search-history-del {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    flex-shrink: 0;
+    background: transparent;
+    border: none;
+    color: var(--text-dim);
+    cursor: pointer;
+    transition: color var(--t-fast), background var(--t-fast);
+}
+.search-history-del {
+    font-size: 18px;
+    line-height: 1;
+    font-weight: 400;
+}
+.search-history-row:hover .search-history-del { color: var(--text); }
+.search-history-del:hover { color: var(--danger); background: var(--danger-soft); }
 .topbar-actions { display: flex; align-items: center; gap: 8px; margin-left: auto; }
 
 /* View toggle (Cards / List) */
@@ -709,6 +813,13 @@ input[type="range"]::-webkit-slider-thumb {
     background: var(--accent-soft);
     box-shadow: inset 0 0 0 2px var(--accent);
 }
+/* Keyboard cursor (j/k nav) — distinct from selected so a focused card
+   stays visible after the slideover closes. */
+.entry-card.is-cursor,
+.entry-row.is-cursor {
+    outline: 2px solid var(--accent);
+    outline-offset: -2px;
+}
 
 /* === List view layout === */
 /* Cards are flattened into a single horizontal row using flexbox + `order`.
@@ -904,7 +1015,7 @@ input[type="range"]::-webkit-slider-thumb {
     font-size: 12px;
     white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
 }
-.entry-fav, .entry-del, .entry-dup {
+.entry-fav, .entry-del, .entry-dup, .entry-pin {
     color: var(--text-faint);
     background: transparent; border: none;
     padding: 4px;
@@ -913,6 +1024,8 @@ input[type="range"]::-webkit-slider-thumb {
 }
 .entry-fav.is-on { color: var(--warning); }
 .entry-fav:hover { color: var(--warning); transform: scale(1.1); }
+.entry-pin.is-on { color: var(--accent); }
+.entry-pin:hover { color: var(--accent); transform: scale(1.1); }
 .entry-dup {
     color: var(--text-dim);
     opacity: 0;
@@ -1733,6 +1846,18 @@ input[type="range"]::-webkit-slider-thumb {
 }
 .new-entry-menu .dropdown-item:hover { background: var(--accent-soft); }
 .new-entry-menu .dropdown-item svg { width: 14px; height: 14px; }
+.new-entry-menu .dropdown-sep {
+    height: 1px;
+    background: var(--border-soft);
+    margin: 4px 0;
+}
+.new-entry-menu .dropdown-section {
+    padding: 4px 10px 2px;
+    font-size: 10px;
+    text-transform: uppercase;
+    letter-spacing: 0.5px;
+    color: var(--text-faint);
+}
 
 /* ---- Quick search modal (tray menu) ------------------ */
 .quick-search-panel {
@@ -1861,6 +1986,12 @@ input[type="range"]::-webkit-slider-thumb {
     z-index: 50;
 }
 .slideover.is-open { transform: translateX(0); }
+/* Push the app shell to the left when the slideover is open, so the
+   table, sort buttons, pagination and search bar are no longer hidden
+   behind it. Width matches .slideover (420px) — bumped to 100% via the
+   responsive override below 720px. */
+body:has(.slideover.is-open) #appShell { margin-right: 420px; }
+#appShell { transition: margin-right var(--t-base); }
 .slideover-header {
     display: flex; align-items: center; justify-content: space-between;
     padding: 16px 20px;
@@ -2156,6 +2287,9 @@ input[type="range"]::-webkit-slider-thumb {
     .topbar { padding: 12px 16px; }
     .content { padding: 16px; }
     .slideover { width: 100%; }
+    /* On a narrow viewport the slideover fills the screen — no point
+       pushing the shell, the table isn't visible anyway. */
+    body:has(.slideover.is-open) #appShell { margin-right: 0; }
 }
 
 /* ---- 17. AUTOFILL PICKER -------------------------------- */
diff --git a/delphi-backend/Handlers/PM.Handler.Attachments.pas b/delphi-backend/Handlers/PM.Handler.Attachments.pas
index c6f4ee5..8a670b5 100644
--- a/delphi-backend/Handlers/PM.Handler.Attachments.pas
+++ b/delphi-backend/Handlers/PM.Handler.Attachments.pas
@@ -260,6 +260,125 @@ begin
   end;
 end;
 
+// ===== GET /attachments/all ==================================================
+// Lightweight listing of every attachment id+iv for the current user.
+// Used by the master-pw rotation flow to enumerate what needs re-encryption.
+// No blob shipped — fetched per-id only when the client is ready to re-encrypt.
+
+procedure HandleListAllAttachments(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId: Integer;
+  LQ: TFDQuery;
+  LArr: TJSONArray;
+  LObj: TJSONObject;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LArr := TJSONArray.Create;
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'SELECT id, entry_id FROM entry_attachments ' +
+        'WHERE user_id = :uid';
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.Open;
+      while not LQ.Eof do
+      begin
+        LObj := TJSONObject.Create;
+        LObj.AddPair('id',       TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
+        LObj.AddPair('entry_id', TJSONNumber.Create(LQ.FieldByName('entry_id').AsInteger));
+        LArr.Add(LObj);
+        LQ.Next;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendJSON(AResponse, LArr);
+end;
+
+// ===== PUT /attachments/{id} =================================================
+// Update only the ciphertext + iv. Used by master-pw rotation to swap to
+// the new vault key. Filename/mime/size stay untouched.
+
+procedure HandleUpdateAttachmentBlob(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LBody: TJSONObject;
+  LBlob, LIv: string;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  LBody := TJSONHelper.ReadBody(ARequest);
+  try
+    LBlob := LBody.GetValue<string>('encrypted_blob', '');
+    LIv   := LBody.GetValue<string>('iv',             '');
+  finally
+    LBody.Free;
+  end;
+
+  if (LBlob = '') or (LIv = '') then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Missing encrypted_blob / iv');
+    Exit;
+  end;
+  if Length(LBlob) > MAX_ATTACHMENT_B64 then
+  begin
+    TJSONHelper.SendError(AResponse, 413, 'Attachment too large');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'UPDATE entry_attachments SET encrypted_blob = :blob, iv = :iv ' +
+        'WHERE id = :id AND user_id = :uid';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ParamByName('blob').AsString := LBlob;
+      LQ.ParamByName('iv').AsString   := LIv;
+      LQ.ExecSQL;
+      if LQ.RowsAffected = 0 then
+      begin
+        TJSONHelper.SendError(AResponse, 404, 'Not found');
+        Exit;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendOK(AResponse, 'Updated');
+end;
+
 // ===== DELETE /attachments/{id} ==============================================
 
 procedure HandleDeleteAttachment(ARequest: TIdHTTPRequestInfo;
@@ -311,7 +430,9 @@ end;
 initialization
   Router.Register('GET',    '/entries/(\d+)/attachments', HandleListAttachments);
   Router.Register('POST',   '/entries/(\d+)/attachments', HandleCreateAttachment);
+  Router.Register('GET',    '/attachments/all',            HandleListAllAttachments);
   Router.Register('GET',    '/attachments/(\d+)',          HandleGetAttachment);
+  Router.Register('PUT',    '/attachments/(\d+)',          HandleUpdateAttachmentBlob);
   Router.Register('DELETE', '/attachments/(\d+)',          HandleDeleteAttachment);
 
 end.
diff --git a/delphi-backend/Handlers/PM.Handler.Auth.pas b/delphi-backend/Handlers/PM.Handler.Auth.pas
index bb792c0..ccb3d15 100644
--- a/delphi-backend/Handlers/PM.Handler.Auth.pas
+++ b/delphi-backend/Handlers/PM.Handler.Auth.pas
@@ -772,6 +772,7 @@ var
   LValid: Boolean;
   LEntryId: Integer;
   LEncPwd, LIv, LTotpSec, LTotpIv: string;
+  LNewToken, LNewCsrf: string;
 begin
   try
     LUserId := Authenticate(ARequest, AResponse);
@@ -941,18 +942,18 @@ begin
             LQ.ParamByName('iv').AsString   := LIv;
             // TOTP / custom_fields are optional per entry — clear when
             // empty so existing-NULL rows don't get stomped with empty strings.
-            LQ.ParamByName('ts').DataType   := ftString;
-            LQ.ParamByName('tiv').DataType  := ftString;
-            LQ.ParamByName('cf').DataType   := ftString;
-            LQ.ParamByName('cfiv').DataType := ftString;
+            LQ.ParamByName('ts').DataType   := ftMemo;
+            LQ.ParamByName('tiv').DataType  := ftMemo;
+            LQ.ParamByName('cf').DataType   := ftMemo;
+            LQ.ParamByName('cfiv').DataType := ftMemo;
             if LTotpSec.IsEmpty then LQ.ParamByName('ts').Clear
-            else                      LQ.ParamByName('ts').AsString := LTotpSec;
+            else                      LQ.ParamByName('ts').Value := LTotpSec;
             if LTotpIv = '' then LQ.ParamByName('tiv').Clear
-            else                  LQ.ParamByName('tiv').AsString := LTotpIv;
+            else                  LQ.ParamByName('tiv').Value := LTotpIv;
             if LCf = '' then LQ.ParamByName('cf').Clear
-            else              LQ.ParamByName('cf').AsString := LCf;
+            else              LQ.ParamByName('cf').Value := LCf;
             if LCfIv = '' then LQ.ParamByName('cfiv').Clear
-            else                LQ.ParamByName('cfiv').AsString := LCfIv;
+            else                LQ.ParamByName('cfiv').Value := LCfIv;
             LQ.ExecSQL;
           end;
           // Password history is encrypted with the OLD vault key — we
@@ -993,6 +994,11 @@ begin
     end;
 
     DeleteAllUserSessions(LUserId);
+    // Immediately mint a fresh session for the calling client so the
+    // very next request doesn't bounce with ESessionRejected. The user
+    // hasn't logged out — they rotated their key, the UI session is
+    // still legitimate.
+    CreateSession(LUserId, LNewToken, LNewCsrf);
   finally
     LBody.Free;
   end;
@@ -1004,6 +1010,8 @@ begin
   LObj.AddPair('message', 'Master password changed');
   LObj.AddPair('salt',          LNewSalt);
   LObj.AddPair('kdfIterations', TJSONNumber.Create(PBKDF2_ITERATIONS_TARGET));
+  LObj.AddPair('token',         LNewToken);
+  LObj.AddPair('csrf',          LNewCsrf);
   TJSONHelper.SendJSON(AResponse, LObj);
 end;
 
diff --git a/delphi-backend/Handlers/PM.Handler.Entries.pas b/delphi-backend/Handlers/PM.Handler.Entries.pas
index c653aa4..95433d4 100644
--- a/delphi-backend/Handlers/PM.Handler.Entries.pas
+++ b/delphi-backend/Handlers/PM.Handler.Entries.pas
@@ -104,6 +104,7 @@ begin
         else
           LObj.AddPair('deleted_at', ISODateTimeField(LQ.FieldByName('deleted_at')));
         LObj.AddPair('favorite', TJSONNumber.Create(LQ.FieldByName('favorite').AsInteger));
+        LObj.AddPair('pinned',   TJSONNumber.Create(LQ.FieldByName('pinned').AsInteger));
         LObj.AddPair('tags', LQ.FieldByName('tags').AsString);
         // TOTP fields are NULL when the entry has no 2FA configured. We emit
         // JSON null instead of '' so the client can distinguish "no TOTP" from
@@ -126,6 +127,11 @@ begin
         var LKindVal := LQ.FieldByName('kind').AsString;
         if LKindVal = '' then LKindVal := 'login';
         LObj.AddPair('kind', LKindVal);
+        // Template subtype. Empty = generic; otherwise drives UI labels.
+        if LQ.FieldByName('template').IsNull then
+          LObj.AddPair('template', TJSONNull.Create)
+        else
+          LObj.AddPair('template', LQ.FieldByName('template').AsString);
         // Custom fields: opaque ciphertext + IV, treated identically to
         // password / totp_secret. NULL → JSON null so the client can
         // distinguish "never set" from "empty array stored".
@@ -167,7 +173,7 @@ var
   LUserId, LNewId: Integer;
   LBody, LObj: TJSONObject;
   LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LNow, LTotpSec, LTotpIv,
-    LKind, LCf, LCfIv: string;
+    LKind, LCf, LCfIv, LIcon, LTemplate: string;
   LQ: TFDQuery;
 begin
   try
@@ -192,6 +198,8 @@ begin
     LKind    := LBody.GetValue<string>('kind', 'login');
     LCf      := LBody.GetValue<string>('custom_fields', '');
     LCfIv    := LBody.GetValue<string>('custom_fields_iv', '');
+    LIcon    := LBody.GetValue<string>('icon_b64', '');
+    LTemplate:= Trim(LBody.GetValue<string>('template', ''));
   finally
     LBody.Free;
   end;
@@ -221,9 +229,9 @@ begin
         'INSERT INTO vault_entries ' +
         '(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
         ' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
-        ' created_at, updated_at, password_changed_at) ' +
+        ' icon_b64, template, created_at, updated_at, password_changed_at) ' +
         'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
-        ' :cf, :cfiv, :c, :c2, :c)';
+        ' :cf, :cfiv, :ic, :tpl, :c, :c2, :c)';
       LQ.ParamByName('uid').AsInteger := LUserId;
       LQ.ParamByName('s').AsString  := LSite;
       LQ.ParamByName('tt').AsString := LTitle;
@@ -236,23 +244,28 @@ begin
       // assigned a string and sometimes Clear()ed to NULL — without a
       // prior typed assignment, .Clear raises "data type unknown" on
       // SQLite. Declare ftString up front for the optional TOTP fields.
-      LQ.ParamByName('ts').DataType  := ftString;
-      LQ.ParamByName('tiv').DataType := ftString;
+      LQ.ParamByName('ts').DataType  := ftMemo;
+      LQ.ParamByName('tiv').DataType := ftMemo;
       // Store empty TOTP fields as NULL so the GET endpoint emits JSON null
       // rather than '' — keeps client-side "has TOTP?" checks unambiguous.
       if LTotpSec = '' then
         LQ.ParamByName('ts').Clear
       else
-        LQ.ParamByName('ts').AsString := LTotpSec;
+        LQ.ParamByName('ts').Value := LTotpSec;
       if LTotpIv = '' then
         LQ.ParamByName('tiv').Clear
       else
-        LQ.ParamByName('tiv').AsString := LTotpIv;
+        LQ.ParamByName('tiv').Value := LTotpIv;
       LQ.ParamByName('k').AsString    := LKind;
-      LQ.ParamByName('cf').DataType   := ftString;
-      LQ.ParamByName('cfiv').DataType := ftString;
-      if LCf   = '' then LQ.ParamByName('cf').Clear   else LQ.ParamByName('cf').AsString   := LCf;
-      if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').AsString := LCfIv;
+      LQ.ParamByName('cf').DataType   := ftMemo;
+      LQ.ParamByName('cfiv').DataType := ftMemo;
+      if LCf   = '' then LQ.ParamByName('cf').Clear   else LQ.ParamByName('cf').Value   := LCf;
+      if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
+      LQ.ParamByName('ic').DataType := ftMemo;
+      if LIcon = '' then LQ.ParamByName('ic').Clear   else LQ.ParamByName('ic').Value   := LIcon;
+      LQ.ParamByName('tpl').DataType := ftString;
+      if LTemplate = '' then LQ.ParamByName('tpl').Clear
+      else                   LQ.ParamByName('tpl').AsString := LTemplate;
       LQ.ParamByName('c').AsString  := LNow;
       LQ.ParamByName('c2').AsString := LNow;
       LQ.ExecSQL;
@@ -284,7 +297,8 @@ var
   LUserId, LId: Integer;
   LBody: TJSONObject;
   LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LNow, LTotpSec, LTotpIv,
-    LKind, LCf, LCfIv: string;
+    LKind, LCf, LCfIv, LTemplate: string;
+  LHasTemplate: Boolean;
   LQ: TFDQuery;
 begin
   try
@@ -315,6 +329,10 @@ begin
     LKind    := LBody.GetValue<string>('kind', 'login');
     LCf      := LBody.GetValue<string>('custom_fields', '');
     LCfIv    := LBody.GetValue<string>('custom_fields_iv', '');
+    // Template is only updated when the caller explicitly sends it —
+    // partial PUTs (drag-to-folder) must not wipe it.
+    LHasTemplate := LBody.GetValue('template') <> nil;
+    LTemplate    := Trim(LBody.GetValue<string>('template', ''));
   finally
     LBody.Free;
   end;
@@ -365,6 +383,10 @@ begin
 
       // password_changed_at fires only when the ciphertext actually
       // changes — same conditional used above for history insertion.
+      // template column is updated only when the caller sent it, so a
+      // partial PUT (drag-to-folder, move-to-folder) doesn't wipe it.
+      var LTemplateSet := '';
+      if LHasTemplate then LTemplateSet := ', template=:tpl';
       LQ.SQL.Text :=
         'UPDATE vault_entries ' +
         'SET site=:s, title=:tt, username=:u, encrypted_password=:e, iv=:i, ' +
@@ -372,7 +394,8 @@ begin
         '    custom_fields=:cf, custom_fields_iv=:cfiv, ' +
         '    updated_at=:c, ' +
         '    password_changed_at = CASE WHEN encrypted_password <> :e ' +
-        '                          THEN :c ELSE password_changed_at END ' +
+        '                          THEN :c ELSE password_changed_at END' +
+        LTemplateSet + ' ' +
         'WHERE id=:id AND user_id=:uid';
       LQ.ParamByName('s').AsString    := LSite;
       LQ.ParamByName('tt').AsString   := LTitle;
@@ -383,23 +406,29 @@ begin
       LQ.ParamByName('t').AsString    := LTags;
       // Declare TOTP param types so .Clear works on first use (FireDAC
       // needs an inferred or explicit DataType before NULL binding).
-      LQ.ParamByName('ts').DataType  := ftString;
-      LQ.ParamByName('tiv').DataType := ftString;
+      LQ.ParamByName('ts').DataType  := ftMemo;
+      LQ.ParamByName('tiv').DataType := ftMemo;
       // Clearing TOTP (user removed 2FA from this entry) is signaled by an
       // empty string in the request → store NULL in the DB.
       if LTotpSec = '' then
         LQ.ParamByName('ts').Clear
       else
-        LQ.ParamByName('ts').AsString := LTotpSec;
+        LQ.ParamByName('ts').Value := LTotpSec;
       if LTotpIv = '' then
         LQ.ParamByName('tiv').Clear
       else
-        LQ.ParamByName('tiv').AsString := LTotpIv;
+        LQ.ParamByName('tiv').Value := LTotpIv;
       LQ.ParamByName('k').AsString    := LKind;
-      LQ.ParamByName('cf').DataType   := ftString;
-      LQ.ParamByName('cfiv').DataType := ftString;
-      if LCf   = '' then LQ.ParamByName('cf').Clear   else LQ.ParamByName('cf').AsString   := LCf;
-      if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').AsString := LCfIv;
+      LQ.ParamByName('cf').DataType   := ftMemo;
+      LQ.ParamByName('cfiv').DataType := ftMemo;
+      if LCf   = '' then LQ.ParamByName('cf').Clear   else LQ.ParamByName('cf').Value   := LCf;
+      if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
+      if LHasTemplate then
+      begin
+        LQ.ParamByName('tpl').DataType := ftString;
+        if LTemplate = '' then LQ.ParamByName('tpl').Clear
+        else                   LQ.ParamByName('tpl').AsString := LTemplate;
+      end;
       LQ.ParamByName('c').AsString    := LNow;
       LQ.ParamByName('id').AsInteger  := LId;
       LQ.ParamByName('uid').AsInteger := LUserId;
@@ -558,6 +587,51 @@ begin
   TJSONHelper.SendOK(AResponse, 'Toggled');
 end;
 
+// ===== POST /entries/{id}/pin ================================================
+// Same shape as /favorite: flip the pinned bit, no body required.
+procedure HandleTogglePin(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+    RequireCSRF(ARequest, AResponse, LUserId);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'UPDATE vault_entries ' +
+        'SET pinned = CASE WHEN pinned=1 THEN 0 ELSE 1 END ' +
+        'WHERE id=:id AND user_id=:uid';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ExecSQL;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+
+  LogAudit(LUserId, 'toggle_pin', GetClientIP(ARequest));
+  TJSONHelper.SendOK(AResponse, 'Toggled');
+end;
+
 // ===== POST /entries/{id}/touch ==============================================
 // Bumps accessed_at. Called from JS on copy / slideover-open so the sidebar
 // "Recent" view can show what the user actually uses. Auth-only (no CSRF
@@ -637,12 +711,12 @@ begin
     LBody.Free;
   end;
 
-  // Soft cap to prevent a misbehaving fetcher from ballooning the DB.
-  // 32x32 PNG favicons rarely exceed 4 KB; 64 KB leaves room for SVG / 64x64.
-  // Soft cap. Most favicons are < 10 KB; bumped to 256 KB because DDG
-  // occasionally serves the brand's full-resolution PNG (deepseek.com
-  // came back at 200+ KB) and we want those to be cacheable too.
-  if Length(LIcon) > 262144 then
+  // Soft cap on the SERIALISED data URI ('data:image/...;base64,...'). The
+  // favicon fetcher allows 256 KB raw, which becomes ~350 KB after base64
+  // + prefix overhead. Cap at 512 KB chars so a max-raw fetch + a bit of
+  // headroom still passes (the silent 413 here was deleting deepseek's
+  // 200+ KB icon on lock/unlock since saveEntryIcon swallows the error).
+  if Length(LIcon) > 524288 then
   begin
     TJSONHelper.SendError(AResponse, 413, 'Icon too large');
     Exit;
@@ -658,7 +732,7 @@ begin
         'WHERE id=:id AND user_id=:uid';
       LQ.ParamByName('ic').DataType := ftMemo;  // long text → ftMemo on SQLite
       if LIcon = '' then LQ.ParamByName('ic').Clear
-      else                LQ.ParamByName('ic').AsString := LIcon;
+      else                LQ.ParamByName('ic').Value := LIcon;
       LQ.ParamByName('id').AsInteger  := LId;
       LQ.ParamByName('uid').AsInteger := LUserId;
       LQ.ExecSQL;
@@ -862,10 +936,11 @@ end;
 procedure HandleBulkImport(ARequest: TIdHTTPRequestInfo;
   AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
 var
-  LUserId, I, LImported: Integer;
+  LUserId, I, LImported, LNewId: Integer;
   LBody, LObj, LEntry: TJSONObject;
-  LArr: TJSONArray;
-  LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LTotpSec, LTotpIv, LNow: string;
+  LArr, LIds: TJSONArray;
+  LSite, LTitle, LUser, LFolder, LEnc, LIV, LTags, LTotpSec, LTotpIv, LNow,
+    LKind, LCf, LCfIv, LIcon, LTemplate: string;
   LQ: TFDQuery;
 begin
   try
@@ -894,6 +969,10 @@ begin
 
     LNow := FormatDateTime('yyyy-mm-dd hh:nn:ss', Now);
     LImported := 0;
+    // Track newly-inserted IDs in input order so the client can upload
+    // attachments to the right entry afterwards. Skipped rows emit -1
+    // so the array remains positionally aligned with the input.
+    LIds := TJSONArray.Create;
 
     DB.Lock;
     try
@@ -905,14 +984,24 @@ begin
           LQ.SQL.Text :=
             'INSERT INTO vault_entries ' +
             '(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
-            ' folder, tags, totp_secret, totp_iv, created_at, updated_at) ' +
-            'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :c, :c2)';
-          // Declare optional TOTP param types ONCE — the prepared statement
-          // is reused across every imported entry, and FireDAC needs the
+            ' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
+            ' icon_b64, template, created_at, updated_at) ' +
+            'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
+            ' :cf, :cfiv, :ic, :tpl, :c, :c2)';
+          // Declare optional param types ONCE — the prepared statement is
+          // reused across every imported entry, and FireDAC needs the
           // type set before the first .Clear call would otherwise fail
-          // for a row without TOTP.
-          LQ.ParamByName('ts').DataType  := ftString;
-          LQ.ParamByName('tiv').DataType := ftString;
+          // for a row that omits the field. ftMemo (unlimited TEXT) is
+          // mandatory for icon_b64 + custom_fields which often exceed
+          // FireDAC's default ftString cap (~4000 chars) — a 256 KB
+          // icon would otherwise be silently truncated to nothing on
+          // the next read.
+          LQ.ParamByName('ts').DataType   := ftMemo;
+          LQ.ParamByName('tiv').DataType  := ftMemo;
+          LQ.ParamByName('cf').DataType   := ftMemo;
+          LQ.ParamByName('cfiv').DataType := ftMemo;
+          LQ.ParamByName('ic').DataType   := ftMemo;
+          LQ.ParamByName('tpl').DataType  := ftString;
 
           for I := 0 to LArr.Count - 1 do
           begin
@@ -926,11 +1015,27 @@ begin
             LTags    := Trim(LEntry.GetValue<string>('tags', ''));
             LTotpSec := LEntry.GetValue<string>('totp_secret', '');
             LTotpIv  := LEntry.GetValue<string>('totp_iv', '');
+            LKind    := LEntry.GetValue<string>('kind', 'login');
+            if (LKind <> 'login') and (LKind <> 'note') then LKind := 'login';
+            LCf      := LEntry.GetValue<string>('custom_fields', '');
+            LCfIv    := LEntry.GetValue<string>('custom_fields_iv', '');
+            LIcon    := LEntry.GetValue<string>('icon_b64', '');
+            LTemplate:= Trim(LEntry.GetValue<string>('template', ''));
 
-            // Skip silently if a row is missing the minimum required fields
-            // (site + ciphertext). Better than failing the whole batch on
-            // one bad row when the user is importing 500+ entries.
-            if (LSite = '') or (LEnc = '') or (LIV = '') then Continue;
+            // Ciphertext is always required. Site is required only for
+            // logins — notes legitimately have no site (their body lives
+            // inside the encrypted blob). Skip silently rather than fail
+            // the whole batch on one bad row.
+            if (LEnc = '') or (LIV = '') then
+            begin
+              LIds.AddElement(TJSONNumber.Create(-1));
+              Continue;
+            end;
+            if (LKind = 'login') and (LSite = '') then
+            begin
+              LIds.AddElement(TJSONNumber.Create(-1));
+              Continue;
+            end;
 
             LQ.ParamByName('uid').AsInteger := LUserId;
             LQ.ParamByName('s').AsString  := LSite;
@@ -941,12 +1046,20 @@ begin
             LQ.ParamByName('f').AsString  := LFolder;
             LQ.ParamByName('t').AsString  := LTags;
             if LTotpSec = '' then LQ.ParamByName('ts').Clear
-            else                   LQ.ParamByName('ts').AsString := LTotpSec;
+            else                   LQ.ParamByName('ts').Value := LTotpSec;
             if LTotpIv = '' then LQ.ParamByName('tiv').Clear
-            else                  LQ.ParamByName('tiv').AsString := LTotpIv;
+            else                  LQ.ParamByName('tiv').Value := LTotpIv;
+            LQ.ParamByName('k').AsString  := LKind;
+            if LCf   = '' then LQ.ParamByName('cf').Clear   else LQ.ParamByName('cf').Value   := LCf;
+            if LCfIv = '' then LQ.ParamByName('cfiv').Clear else LQ.ParamByName('cfiv').Value := LCfIv;
+            if LIcon = '' then LQ.ParamByName('ic').Clear   else LQ.ParamByName('ic').Value   := LIcon;
+            if LTemplate = '' then LQ.ParamByName('tpl').Clear
+            else                   LQ.ParamByName('tpl').AsString := LTemplate;
             LQ.ParamByName('c').AsString  := LNow;
             LQ.ParamByName('c2').AsString := LNow;
             LQ.ExecSQL;
+            LNewId := DB.Connection.GetLastAutoGenValue('vault_entries');
+            LIds.AddElement(TJSONNumber.Create(LNewId));
             Inc(LImported);
           end;
         finally
@@ -967,6 +1080,7 @@ begin
   LogAudit(LUserId, Format('bulk_import %d entries', [LImported]), GetClientIP(ARequest));
   LObj := TJSONObject.Create;
   LObj.AddPair('imported', TJSONNumber.Create(LImported));
+  LObj.AddPair('ids',      LIds);
   TJSONHelper.SendJSON(AResponse, LObj);
 end;
 
@@ -1026,6 +1140,7 @@ initialization
   Router.Register('POST',   '/entries/(\d+)/restore',  HandleRestoreEntry);
   Router.Register('POST',   '/entries/(\d+)/favorite', HandleToggleFavorite);
   Router.Register('POST',   '/entries/(\d+)/touch',    HandleTouchEntry);
+  Router.Register('POST',   '/entries/(\d+)/pin',      HandleTogglePin);
   Router.Register('POST',   '/entries/(\d+)/icon',     HandleSetEntryIcon);
   Router.Register('GET',    '/entries/(\d+)/history',  HandleGetEntryHistory);
   Router.Register('GET',    '/entries/count',          HandleEntriesCount);
diff --git a/delphi-backend/Source/PM.Bridge.pas b/delphi-backend/Source/PM.Bridge.pas
index 973202f..6a4d72f 100644
--- a/delphi-backend/Source/PM.Bridge.pas
+++ b/delphi-backend/Source/PM.Bridge.pas
@@ -178,6 +178,11 @@ type
     // the tray icon mute. Configured from the JS settings panel.
     property ShowNotifications: Boolean
       read FShowNotifications write FShowNotifications;
+    // Already-shown flag for the one-time "still running in the tray"
+    // balloon. Exposed so the host can pre-mark it true on autostart
+    // launches (the user didn't actively minimise — no need to inform them).
+    property BalloonShown: Boolean
+      read FBalloonShown write FBalloonShown;
     // Fired on main thread when the autofill hotkey fires.
     // Args: (ATargetHWND, AWindowTitle). Handler calls ExecuteJavaScript
     // to let JS match the title against vault entries.
diff --git a/delphi-backend/Source/PM.Database.pas b/delphi-backend/Source/PM.Database.pas
index 7fef05b..0081509 100644
--- a/delphi-backend/Source/PM.Database.pas
+++ b/delphi-backend/Source/PM.Database.pas
@@ -306,6 +306,14 @@ begin
   // the "aged password" badge. Legacy rows: NULL → JS falls back to
   // updated_at, then created_at.
   AddColumnIfMissing('vault_entries', 'password_changed_at', 'DATETIME');
+  // Pinned entries float to the top of every view, regardless of sort.
+  // Independent from favorite (which is a filter, not a sort override).
+  AddColumnIfMissing('vault_entries', 'pinned',             'INTEGER DEFAULT 0');
+  // Template identifier: empty/NULL = generic login or note; otherwise a
+  // string like 'credit-card', 'ssh-key', 'server', 'recovery-codes'.
+  // Drives the card/table label so notes-with-fields read as "Credit card"
+  // instead of the generic "Encrypted note" placeholder.
+  AddColumnIfMissing('vault_entries', 'template',           'TEXT');
   // Per-folder customisation. NULL = no override → JS uses the default
   // accent + i-folder symbol.
   AddColumnIfMissing('folders',       'color',             'TEXT');
diff --git a/delphi-backend/Source/PM.Favicon.pas b/delphi-backend/Source/PM.Favicon.pas
index f1f3467..6634659 100644
--- a/delphi-backend/Source/PM.Favicon.pas
+++ b/delphi-backend/Source/PM.Favicon.pas
@@ -1,4 +1,4 @@
-unit PM.Favicon;
+unit PM.Favicon;
 
 {
   Favicon proxy — fetches a website's icon and returns a base64 data URI
@@ -44,7 +44,7 @@ const
   HTTP_TIMEOUT_MS     = 5000;
   // DDG returns a generic placeholder for unknown domains. Bigger threshold
   // than 100 to avoid treating its blank globe glyph as a real icon.
-  MIN_REAL_ICON_BYTES = 500;
+  MIN_REAL_ICON_BYTES = 300;
   // Privacy stance: DDG-only fetches. We don't fall back to the site's
   // own /favicon.ico because that would leak DNS to every domain stored
   // in the vault. For sites DDG doesn't index, the user can upload a
diff --git a/delphi-backend/Source/PM.QuickUnlock.pas b/delphi-backend/Source/PM.QuickUnlock.pas
index 56296ca..e9926e2 100644
--- a/delphi-backend/Source/PM.QuickUnlock.pas
+++ b/delphi-backend/Source/PM.QuickUnlock.pas
@@ -1,4 +1,4 @@
-unit PM.QuickUnlock;
+unit PM.QuickUnlock;
 
 {
   Quick unlock — persistent on-device cache of the vault key, encrypted
@@ -85,18 +85,42 @@ function CryptUnprotectData(pDataIn: PDataBlob; ppszDataDescr: PPWideChar;
 function LocalFree(hMem: HLOCAL): HLOCAL; stdcall;
   external 'kernel32.dll' name 'LocalFree';
 
+var LoadedConfig:Boolean=False;
+    StorageDir_:String='';
 // ---------------------------------------------------------------------------
 //  Storage helpers
 // ---------------------------------------------------------------------------
-
+procedure LoadConfig;
+begin
+  if LoadedConfig then
+    exit;
+  Var ConfigList := TStringList.Create;
+  try
+    StorageDir_ := TPath.Combine(ExtractFileDir(ParamStr(0)),'config.txt');
+    if TFile.Exists(StorageDir_) then
+    begin
+      ConfigList.LoadFromFile(StorageDir_);
+      StorageDir_ := ConfigList.Values['PathUnlock'];
+      if StorageDir_.ToLower.Equals('same') then
+        StorageDir_ := ExtractFileDir(ParamStr(0))
+    end
+    else
+      StorageDir_ := '';
+  finally
+    FreeAndNil(ConfigList);
+    LoadedConfig :=True;
+  end;
+end;
 function StorageDir: string;
 begin
   // %LOCALAPPDATA%\PMServer — per-user, roaming-disabled. DPAPI keys live
   // alongside the user profile so they survive Windows updates but not
   // a profile reset.
-  Result := TPath.Combine(
-    GetEnvironmentVariable('LOCALAPPDATA'),
-    'PMServer');
+  LoadConfig;
+  if StorageDir_.IsEmpty then
+    Result := TPath.Combine(GetEnvironmentVariable('LOCALAPPDATA'),'PMServer')
+  else
+    Result :=StorageDir_;
 end;
 
 function StorageFile: string;
diff --git a/delphi-backend/UMainForm.pas b/delphi-backend/UMainForm.pas
index c9d6565..cb5841c 100644
--- a/delphi-backend/UMainForm.pas
+++ b/delphi-backend/UMainForm.pas
@@ -13,6 +13,8 @@
 
 interface
 
+
+
 uses
   System.SysUtils, System.Classes, System.UITypes, System.NetEncoding,
   System.StrUtils, System.Generics.Collections, System.IOUtils, System.JSON,
@@ -33,7 +35,10 @@ uses
   PM.HTTPServer, PM.Bridge, PM.QuickUnlock, PM.UserPrefs, PM.AutoStart,
   PM.Favicon,
   FMX.Platform.Win, FMX.Menus;  // WindowHandleToPlatform → HWND for visibility check
-
+const
+  // Bump on each release. Surfaced to JS via cmd://app/version, displayed
+  // in Settings → Account so users can report bugs with the right build.
+  APP_VERSION = '1.0.0';
 type
   // Concrete class chosen at compile time. Both inherit from
   // TTMSFNCCustomWebBrowser so we use that as the field type — events
@@ -212,11 +217,15 @@ begin
   // initial Show before we hide it — minimises the visible flash.
   if FindCmdLineSwitch('tray', True) then
   begin
+    // Suppress the first-time tray balloon for autostart launches —
+    // it's noise when Windows itself put us in the tray (the user
+    // didn't actively minimise). Manual launches still see it once.
+    FBridge.BalloonShown := True;
     TThread.ForceQueue(nil,
       procedure
       begin
         FBridge.MinimizeToTray;
-        LogLine('Launched with --tray, minimised at startup');
+        LogLine('Launched with --tray, minimised at startup (balloon suppressed)');
       end);
   end;
 end;
@@ -742,6 +751,24 @@ begin
   else if ACmd = 'app/theme' then
     FBridge.ApplyTitleBarTheme(GetParam('mode') = 'dark')
 
+  // Build/version string exposed to JS for the Settings → About panel.
+  // Hardcoded const — bump manually on releases. Kept simple to avoid
+  // pulling Windows resource version info at runtime.
+  else if ACmd = 'app/version' then
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onVersionResult)' +
+      'Bridge.onVersionResult("' + APP_VERSION + '")')
+
+  // Launch context: the HKCU Run entry passes -tray so we can tell
+  // "Windows started me at boot" from "user double-clicked the exe".
+  // Useful for Settings → Account display and for conditional behavior
+  // (e.g. skip first-time tooltips on autostart).
+  else if ACmd = 'app/launch-mode' then
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onLaunchModeResult)' +
+      'Bridge.onLaunchModeResult("' +
+      IfThen(FindCmdLineSwitch('tray', True), 'auto', 'manual') + '")')
+
   // Open the entry's site in the user's default browser. We restrict the
   // scheme to http(s) so JS can't smuggle a file:// or other handler that
   // would invoke arbitrary Windows applications.
diff --git a/delphi-backend/assets/assets.res b/delphi-backend/assets/assets.res
index 8d365b380f5e0b8835b8066d41fddcea5d3c1c06..64e26fd8d34b4febdc47a1ed2e921c92fa5cfffa 100644
GIT binary patch
delta 34951
zcmeHwd3+n!eP@BefQLwl6e(Vks3CO#lnC(9Em71#QITRDv`ERZWmy8rAqfivAOIvy
z%L?VBagNrh9IpLK8z+{WZMtb3TaG^)Y&Wity4xme*O8m%Xly5vw{0%lQIe)j6CeBi
z{oc%AKuS(}?Cw8HTO=^^<{iKLdT-7?v-t6^8fOjflUE*X+!F9c<I{Hr-#69PZnUi*
zU)$Ky*^!K7MvTENjr%qlZLQ(;>muz&yU~jO+CpvNwl<?JynbU0AJ=aPZ`^L*Yc<vy
zZEM5rYYw-qi=d4>fJcnBk+ydCg;3jg$lYnHbb1T-XZ0F#b&KcGFVEuedZ!m$47FiS
zYF3z8XwB{o&MbMRYj|KaXa02iv`04{I~MqS`E=?~)inKa`SiB)3#Rw4u9-Hr_#Qj3
zajIr|Ye&)a^B?rLM^XbLyQAq$A~m_sjE^-M1F=Xty`?d2@}1C#x@APu_&7Ld#v41Q
z+tx35?Bex{i>Hk~ecHHn&fLLNA~~3th=<Z<68F!4e4%}7q3hN_CYr$GedcH~7Ri`t
zr(Lpp?)1i^^A-<AGLcZ+oCsyCCR-W@Qs!VZ6B>x5rcY)nr+eOCGJWMh#dPf54bx|C
zE-mitlKaL$Wcu90b+}YCeeuX*8Qki$_9~sG(<7l1=JfS<EJDlb=|A4Hj5{mr?Csrc
zoG>S+AN_q}`r>=)-Q84Qts65nK5fK!xa#R|Ze1d?duq6#9M{d1!BaQmnP?=IzFLpQ
zReDUB0|`7j85&3on$wT|g}va)>Cf$1%5z-MdC+QNaFetVj3+YY^o8GVz=W4fmmRK_
zf56FOft#CmdDeXFL$%YR5AL1*?k74c8;vNaJZ)w&(fIITGnEE9rtkbf-HM)ly=uxG
z>0~5+l~#?NublZ$)0g+uO&g!-c<l0nYfGlfHt5r@f7%~PnUS%~NOvlgNI9gFqm^PK
z?`L}b7Z*2-M^eF1XfP5VHd9TThZ6BjC>_1s+|<^dysfdbqa`^VzdSzu{67G$uNaR#
z`N+>VYR3!wk7a+bSX&u0GX?;}Ge2mi6ETMK79&0ui)}9Ed$Gt^d|+fBL+_T?YG_A=
zXZ~Zay}Gh%YIh_x$PgPe`p2TNLAw(pJ(e1Z4B+xmDluwgMoeR;8B2~tjgdq;6E=Eq
zHJUa<&N^CJjQ&U(?I)rT8WE#CZKNYZW@ggJL`TiUSjGUPjOdVb#eINrjInq>z%(!t
z>5rLw!`)lTUdB)qA62)3fRTbs!rC$;zz6;f17p(Vp*>;e>0vXoJ(;u+8KjfTJ>B%k
zTOL3CxYV<<zycF(jr$f+XQ8K}IFd}ZsH=3(i{1q^H{e<2H2YkGr`7p#_fik@S0RN?
z`f6$0MNc6aHJ$}@q{y?fJQ25s1O~=pnc(<z!<&`Pqnnp{Rybd7UFxZGzM#{ko^g7$
z*b|<*A(EEmU`iIw0MbatxFH&c97!AfiA2T-jz=TXYWH<rhm3<`aRcm>nhc~J2ml+Q
zOe!*I48<bDP0dCkWei3K<(aWGz&Dr}1IR-IvFN}FxoX~KZpG6*iYoE=K{GR!il>bL
zs5lWY?l1zQk@#37CLaSvus;<Y95#)_&`>NIH=FW+zt<tQnZPg3(P0k$^BDf>MrahI
zNH4tKTPa9zH)lM!zrPbIsuJ<s94u_0=jq5V7Pz}$l(@e$R@~niF&dtu9~FCAvem7g
zZ~KY?nmzGB^EM+&+tzt2rxJ>yAszb@V5QJdVgL{xgy2mL8o^szP8jjXxCI`@N*l9f
z!WbA!r4y;J(G`O>LGwi17>}A0ElRl<U<pV8Bb_j!86$3jIE`c?8qX*UqaQF-Iyz_?
zOPMp#Sqc<j#GsNCB2@Q#25;Mh5wky9<JrBLdOobLpaV(I^R(?fULQUFd3_Fj;;^T9
zigAuEdlknEIe<nmW*}{VJ=2&QCX$ZEc#I?qnRLdC517VKBpMq7b2?;a^%P{W1qdXY
z4VHmT29#*h=r@^Hqw(=*I?DXsKQ^4^*~<8e?pRWdriTHd!0x`j9wT6^GE(7mCXyLT
zZ_XP9<ZhgTsE<RC^rL-bA_7RI!nb0!!KTeDXoCI5iWNqG*klphWc6!(-E5q8x}#g4
z*5>HPnv7GY>EsH1K^1y6_8;hj{2Dh0H_0S0se9YJizxp0;P@Z^si%aF7WxW`_Ha{f
zMm^QO#lAc4Fibl8X}v1D<)r6-TyF!mJ3RpIOG93!%`{LRNrJUZBRK+jX`#5^jAYVA
zLPQ&5(ToGkM$iloD|`YyjA)z6Eb?IiI2cpXFk?WSf?VPmGc{l)(OY+88Yr+?Q-R7%
z5A3#{*@EuJ$@8jSQDKgU(X-L81#rh?@lb${UDB&`(0(LF+b`)g^yX>)Rp&3F=PLY5
zigO*&l?wj?7Ow@g?QTy6{r)$#`tpHTB5n31GReL~A_jaE)0Zmztu?u)nvG0q%)|{w
z{ApV9tlm7&nVY(qef!Tmsnb);H25)k#q2U{vnvQ=ECW+>EFL{MW*YdHikj(WBbFG5
z#Cl=0MTX5#e`Mf<IoKo}Fz15A$D`xWCXs<uA`J~?rdeY`tU^D*V6d+z6DgQh!h=&l
zgS$_tE$%6iibD0kSeiutVPpFM!<^OFCJ=jswV9b3O+(Jc0~u!47>0#bRD1=lLZcLT
zRbi#Kd;7tz-N$zC>Fqmk@Wx};b>GMwphUqA%LEN<zIx+*+uwu6Yd04c4?)ATA!$JU
zDPUQTQgVs6o-P&YIz8CoS<p6nI13Mq3uc^#RAizFlVlBG967p~?wqeJpes?&91VBw
zyVbLDDm)a8VTr-Cv8B_<OeRgpL40NkN@r4F^gxrbiJw&nhA_wsjDTZvoq_{T=jNOo
zOONDDI>-P7Ps;N$DRn`0KpWGZlDZ65&R4@2ag?ddSpc0(Ln|MRX$4a=p%HA#n|nH(
zN$gEbn5iysW3Wk>Ad`R1>R6=fSUf!v9m)hV*2Reth(%BcOJ2ywVc0&Mh8w_(fl%P6
zNeSm<B5BW4Bp8*KXjN10_6q;a#=CnD?1$uIP)3I)Wq>BgwbM2v^Prb9M`0dc8-9w+
zc#?qFEP!nL4Im;=b_2><|G#?`j4~*%K{J&%efGE*QZ5o1U{#sd2<TGu!L#t3qPMsB
zYmd$bW<J<{^8v3iExP!)UPl{OdTUG5B9CkqyK$v=DQ!)|#$=+KKMTf9bZOihps#$x
zJCB}vLNBMMzOEP1<Hz**^!5{aE&Y70Z|PjsrR`bL;&r|toegLOboMQ8!BRLltbkP`
zGaUdq2*E4l3Uuh7yL`(#^1FeNhnWT-Q^BRsW)O85NG0QRvk?&MBVhN#?dWWmuZq@x
zMPI~%cQnDa4E$FSj>=kOGrk{cpG_9lNzr%`!gC@q2Im2eu-Ng&D9{ImKa@!2+4K>h
zdUz}rfe$E_rx^bb$J~#aSI&;42Y*+qrAyz_eG9LKdA0V_wC{dzU6C}{k%>3a@2&J!
z)1n8wMGF|u!j_msH+&2cD0I)0o=W<w_j}6e?A=<iUvL<r51;oeq0d|g)4%7URy2PG
z0HYa`&VNL!q_d~JbLfd4ub-0pyo(A%AT@2KiwC@hfQ-(p_7>2OpVsT^mjwe$RX2MW
zK7pq2cq9frr34mTo}*P-6y&<pMu|N>KYjH(dPzG^pMS0)7&qe<5Y#_5ngsX~_&-UH
ze*+duj<{lLyd`v7$XiCQnV8m^*YN4O*S*1+%NsOflzdQINXs7cl~*uXJVQ23@C*j&
zP7~svX@VE%+nGlg7@Lh37bysFz(2b>QNWvHBb6>at%vA4U-vfFTuXRSWDRgB3wV2l
zub2Wa0Y6WMyz?pZqPLEW_v^*<<oC3a?CsmUiE<`a4jlBQBJuQ)nF=$xr`gHed0=0!
z$kDwl|DtTnj+*e8puf=oaRT8YUMc^en{YHf5F0}fp~--)#18Q7CZ3W$jvVD4#869%
zM;lM1MkBH4?S(LhWodNhmq21yuJ;x!-=2aC7G?(;mfTe)2Yd0zQEK=Stfs{Wy@fj5
ziUUKm>Y#UFf#{)78(rS&ugu<b(EITP_x(bfN8WaQ89iB{7to4!y_sI;PcL==5G7l*
z`P8#fgPi$=wt^a8hWcCbFF@P5c3A!AD$(wJTQq|@R_mp-W3|4L&f@M|D7sAYSlUEL
zCSw>h_YIH%Zs_z{r9N+-scuKd6=?W&kZyU|S3rONZQnfp+Da825N5q^XwCE&Bi_HZ
zP2PiM2u@uL&i_@c*2oYzNA3*6iG)Z%tb`Q+Y~!6KPzTAPqy})2VFwj<E%$=}n7CCi
z-(Wri4SW&UwFHeZVH)e$4usbWe-}4Ll{7(Mr%%Nof-<Qt@x69Oheu-gmuWUyv-d{5
zHx4_d=5>}cXPem^da_0qk8Twvkb*bvGAuKZNe~;Xc2NBYs3j7g#8+^BOUAqnww@V*
zv7W}n;2kzwO(0%jUNea%l4iWQxEt%W9+oRcItF<vgDde0zX0vK*~Ax@p4Tt#Jh~W-
z4u&`)7^ZvLwFMhwiC9O_v~?ugP-b`_lZxT8!LCX;63aNBN6kzGU#KnZscg(d*at&%
z%p9tW{V4l0E)DOGjFQpets>*ULl*Y*>AsEf1Y3WyXaouFFq}&^1oE$@&6qim3DEX1
zJdmplL`R>{>lV3eIu@zGU+;(+i^00Q;|@CiUMS-yR{EE=0dhOV)E;7tDlpH2@>o*Q
z14DxT>P@YBDi9VFY=Y?@3_HQOCa6}+P*uaD_g)7TjH^uw36|CyNQ{oc`Rs)s2>-*x
zANJZKF_3X?Kv4*GCzw7!x{N;mHK;f&ptOK{#jy19L(G98f1y1ATPP`4Z_qGfX%j?}
zGU;I2+e-g14jK8Y7qz)y8c4U{#D0*Q!rcj=Sq$=91@P4H1HI}-x5+S^=t-I5Ga8?e
z#-=!g@-&24V&YKJ)(8wdYZTyEb-^S?Pham{HpLEn6g{%b4q_83L=-}e%1hzLqeh3(
zYLlfBEh2Y!Ahrc58%c^n18s{yMO;M13nZdq869@SBMC3BIVZna`~X?($uVz$Z6OO-
zD&sf1D+si}gu+EOVnm2fAc$!s;g6*`IB{#PE7cQ*;~|XI7OK+_R2FqX@yV^WoXKL)
zky1|)Mf{M9Q@45j*V~I@kXS(5%CLcy*ktTOBr`l3jpsQJA)~F?YO%_KB9GF`0TtY%
z^1D37R_;zc9l0&o+WZbZMG-);(X|x`5Do`5QRFU9)zl0Wq049vO#tE^71$D?D|m!8
z1$_yKL=epwf}ECc5F-Fl#;70-;>YNl8OF7wI|!PkFZaQ?nHsU>FA%JvnS(6+8AtHo
zAr|8fGB6vZA>IXjkps6fe3gjmVJult8HyzmDNtF<3;;F(7;W|%n-nd&p62j}0~B5y
z_X#qk^UdCd;#@<D?D18Kkw!IldFmFho|~akf=%RkP_Lv*b&!u+?}k^9xE;Sf@T@+s
zOT>48`QI4~kw7qs(YXbQs;gY@P<E_xFCAW6#v((+(gD!95YdqtJsu6y$rIj%R5pxw
z9}iBy7xEWOU2O~=+s%?QdID%e4(JTyYHHN>YuPc)`Sn+6sb|=4qr^jc!#3eYPGSwR
z_*L?v*$Au4kUP1nfhLC>!nQ>Z!}ayIv_&h_bB;sAGG^xdA#p^tiF-yT(%$OTihN`!
zERS7<S@2WD!u>T!JL$p~=NR?>d{bLWKY3HDsamCEN*JchDkIQ%6b7`hs+j8E(w4N&
zyyupp+>IOL((MbQ-ij%EJvOZxkZ6NuIE|oHEVd_}NgPI~ICu(fSYqG=T)H^i7(|rd
z<Mo>(k@09Eg^TG?h|>}Hd6s)8cmXHv9z!6Xvr~hTb%{m#&6pTWNT?`aOxamRB)r1L
zK|2u;kXB>y6LC0%90O}X@C~*VLNHd|k_|QHU5;H2pt~XFV~)Yu0{sNC7zoO7d>qUk
zL6QU!U?*;6_p^8}&ncKm#%%DUkyJwXD9G2Sp~Jgi%D%%Ac7Wrkfm}j#FtAAkuN7+w
zIH}OoAfjltOjb{+jOV2F1mCltvT~lYpWx8=4Jp?XxkpsgeC8N=$;&i9XpfPfv&2yJ
zsjqo!>9dRUxt;(;{y<xh{pX9`W{oY=o@hL7=`WU{k=O*AoRD?wd?^E&qwH|7!A&tJ
zG~{N05JVY~u;5&QvvPFCNjGCSl^9DJ!KCV#v8g^biGXIq5($6-<m${RcAB8HECD`K
z1Scb4ph(#2Na-1<r6dRD`)6Fv0f*TNPqNre_S*&*KNNyu%{5~-%?AF)`(L!>)&PdF
z)d(Eo$p#cMLG3;44k$PH@-AOBZF|sL+7KPUooI*~HXFte%r;0Kj#nmzhhrulp@rY_
zE~c-1)4Pi9e$`t_S9bXd<<acVzv*33=}kuIo}jjbI$rh8EtBz}PEBh?bn~lTwu^C{
z5tEx!{&YO=))vv(A9(AFa>IW2hu%g{l+K^_R%v*g%3kx<`|$y+nk{+N8}&^YeHK%N
z*pD5|!yPObrT{BL%gBnRjC9f*hz>;ukTqn6wp=E$nV8o>Fu61h2%yo$6pi5IMvL6}
zvzZz2glXYQy|$8*=<cxx63I!*T=Bk}j<53i8^Dfx`(wbe&AN(n;VW3Pr^l{%j}%$W
z?zkgc`V((_HU0Stt(v}j@Hgt9?V_ie&MpHIc0Qn&OYZf;GOfPS>C*`Gnh=<94-@p0
z<=VpOiyq$+78E=)n5Y3>1L804Ffa8igKLb;?fm;HJihFk%e2d$78ouNR-DwdTuZn)
z$YLd8W23NnVhqJeBQgkOn}N}ort1y#QT8KG!CFR<5k$(U8_?_RK6tqMAb&v71c&ll
zU~PT|IamuN%vW*rOn3fQy=INoJ=7JL89+n6oQ-=iP*Y|SkrlQ}8+%2vG#Z(S=zw~1
zabyrkjVIWC<&-;T*rRc1#!)<ym~Q)Q1p|WOAw&&cKkr#kj*&t<c1YlX@E^4>8jKok
zv9!APQ(AepIjDW3Y#rzW4m<+gFzVP0M->5BauT9uP$rgy0gLJlqvuecWfxCGlWJP6
zeFu=YYk}vCoZslNp{N<dG+PXo{P<(j1r)T2d<ZgD0)}=DUw5-*-j~>wh#?jrkry7k
z5hXDLp!R3Zfo;bI0GvkA)$-h2V5)2H_Cq_n!=p&U(9_jg6;1hkx*aU379h0#0+<T4
z>-F;Ockf5MWa@SV+P>ML&*jL;Rt}n!%gvIP5xi-5*;B{S6F>b?yFOp8-^8($gIf@(
z6&c}#QRL>eLMismYll;WTItNozS8`-igUe^=64`Qi~vhz_Nk3po%SEIGKmY-+AFJ+
z*pPhtf3Yya!dB3iN4!hup~b+>h3#5(*4L?xluf}w4Z(GT6*0z{P7a_T5(9r5Ziq5g
z(j!P$B68G&KoO*{Q?0_)QqqDg6_Cw%3XgDDI&5$>I7f*fL{MlZnn50Cl|{F^6xptt
zGJ-rHb4<F4J7S9LPe2Z^1Ib?`{K7Nj=#N~93}jFyVMw@_v%RUwB)f`W5H6Ik(uZ7(
z!x?_0mxaUBc*Cs5p_GR)J@lP2r&O?fdv|Z>U0wU~nTn?a1F#?5a00A^c$089!~%nX
zI}CG^-Kg3DJF$7Ipy#llU4Vv3?m+1e(v+Ojhm;cIK$=a#i|0;KCi+%>TbhL;!e0n%
zS_#Rn?FV-r+i`IF{++$h1V;jgqv;6rZD1b~w47Fh)rD`{N0Fdqqp<rnakm4?Z4c~>
zrlqut+q}DL2mjg0akMl_BgUrs`TL<bvYI`SN&dVq0z)^I;Ex9Yqf`JHMrFwFJFvfR
zcki**wqvMZ<axBV1)2k`?fh#s|60Sp*7C1){A)e`+Q7dy;#XTM|Kcaw+H-xD?(cq2
z-?6r}$8JQ1ws-o%YgNlx&Z2i%`G~GaNOC8Dgrp+kWV;|JZ-gx#q;q?H3#Z!Fq7Grz
zswU3=hB=NO?3EaDa1w+TwbM72Er>SAb~UjVrPc%WajfUyfxZJ>2ln<FvLamKh4=32
z>yf`*@+Xy^j1L$RCgcVVK#*2sO{6->?}3XexCj2*%OC6>t-l9%;<o7hz~TK}+@Q~l
z#ZC4w0zIhR8cvzL*YD+T`zGxViTH40r{M1(;*jY;^OOrk)|$Ha_aVR8*S)W2@AkfK
zCYMuclzih|U1Zx1w6`D37h?5+%sMhLElCt%P9#uV1D}VJ>nZc(7%Id#EMo;}xx^wh
zSbSI+hbkg8Hrfv^7*2qS!KV>rCB<w`X=WA|o^yIn#}Za84R@o)7gK`D&wDG5y38jF
zQrwJ11FS#S6{QE2JV8F(v8A~6DK!f`!1EnZdQVJ)cv3T(Tyd>gjZxXh3jzl4L&>C8
zf6eAQkPu-Gbbh$`q8$hzC%IZ6y~%Jh@ab!f3bu`+_KxcdAbjCiHq*(Zws4!PpF9ry
zO*)$7gd^5k-|gxpkL6&dTmxic^hIGVaq*%N>^gk7iMy(8;kuG*Ki0EnzZ(_`c-6W*
zL{Hr7se|JzMX>A==IC%H{%>OA4gppdrvI(D=LkF_-JX_UGkC3K?}9mKrjjTNU}m&%
zf6dmr!K>iJJk-};vo&fuGYOc9_5-sBC0`_66E!{H(Bw!8Ub*Ut`>9rVc?ZO#qT>*x
z3aHk?+;~}ndKjrmdndHqsO;qb0IV?N7%Q+@_pqpZXRP$VIkut3!2UI@e=VHz1ot)J
ze2{BFZGmOY(G9XdU{>VeniRcYN)=cOJAq^zuCvG*I0bSh6O#8gLtN7f$?JYb{1)&r
zY#e29Ap3E1{ARe`PG9dN46Ad}kdX*CCr3Q>%X57&cymorca<2kSV2LZp1Rjl={Ze9
z`?b4jQ1oCqqNp~4E`jAC<|O@czt)=Fc0gO;nd-AzKoBB`#+B1h4{V|!vZbs}4y2r7
z34rd{Ol;1x64lhuIYa8S_$@GX*o$O`45lCCESz;V?HFXpMM%jgQg#yfnqr9x8x#(@
zz{#2=TcyxWjumVBUt!}w9BEZ2lAeIYYo<rU7)DS)MP`%%0T+1BAXIELy&s9wtuhbC
zF-Imq6^Bd4)_DNHg)=V?ZZ&3T>mzdgsPiOaf@3(i?2g9Ca<>=<`fo*gFAPx-9gYW2
zp{#&!G`nOfKYt=hovZaZ3-J-%gc-<uS$^QV^CR@`)p~uuLP#HjUxItwTG{ORt;4Q{
z`9z~`><|sj&u|ZnGV6JRe)5b~xkt6K^|fl{CR>gu!1!}WnxD3YwCD&HJ;RUgEY@qX
z2Ya-~y!7Y|TIGBmS>h2=85iJS-{n@6R4ngB=AK)WTV98Z&=ekxB<Y?%(yIMpaGs*R
zn~-Dw-J7)96UOPy&iIS~Rb~)P%irKo7*J!yE;&Z$Tdq2-H5W<e*|TwKJptV3+9Ual
zP{YYrw2D%(O}Xu96!m4-^=f4W^z|F{N*y<hEwsG~1q_F7(l)Ro=cBuC(i(-TT+`%-
z|NT?tUfyxKb`HXzcdyk-=W*j4s7_}ey-9o4W0xq{e2*YE{6vJ#U>~wqm&BHx$S_oq
z%b8TJCi|Sou!E9Q4*bEc(Ku5&n)j=62S?;2*(H@aDX?+a=tVCGFdfT<!<9yJ_k|%i
zjckhx4&Sv%S*gU+RcH@#Wgvk(*+3=+AB<tbKlZ4b=)w(JRkJPjH~=OD$I1Nsi;9SW
zB--}4wlMn#H*0I>(BIyoRc!6XD!DiTtR@8uBD#e4uvo74a)q*FVhCR$I?TX<c~VSA
z=lH8*K~qAKNC8Z$Og!hS042`$b;r2^M11x93VB`$K&r|>tWk1R5XcQ9k}WpqP&6J*
zk3ecldY8^M`KveKL6))oT$+LIN3s1uRZOTwNFrizj4LXoT_hfrSXms^NH5Gsy!~tq
za&%8^M6T@bKIy5Yqr+MeHKI5N)c~i!7}5(U3?EhP0)Nhxkwe05$o|E!_Us(Gl+pAl
zu4sWKK{X!NIdm!*@cck&D3u#Dv7HQ}8w$fXZt>r7<ydoYEF*};ia=C~`fTi3Ui=7_
zkygGxQwdhhwMuY-Ol7ExUJ*+@xA|ZfkbzofD<K0d7mL6d>JXfE=JMenRaHN2NN@#t
z0V`O+{9(`QxGY0ewH*hXIY`4UjEWKrj7%YIU>8j(DwQotTm-j=X-M(qRb+xhF7iZ}
z`-)qPxpav{TclseFyxK`=^|BL0)<1br?tjvClAIXmTOMizppLbh<!ysUqGtN8CxhA
zce07xUai%dl#_nMcY5JQy~dNEd&;%iB7Em=P>E-t1gxIFas@@u1u07bAS6I9lxua1
z@+T99T1SCF7ix+Jg9)jB(`Bl3e!ahj>Wff)ziAH&5kHYZA=a}GBXawu=`Ez9k9x|i
zhPR}&dJ26`E2cYd(<<m|X(S&uyoy4=EAQ1x=u;^alNM*Rvgyx$YaT7nAU3>vsa{4M
z8Es{eGZ!9hP5u}~*%vb`J3)~96CtFTAgCP5W~m8*!Szkp*}}o_Ew)u^uyc+jfP{0R
zijkhffK^ars_h4R_9Lhafu*7%IpM9^(?jE0|0)LJuX)}Ui`jV-+Cyy%xujx}Er&od
zp#;dLl!>jDD9R_}jJAig&uZVF+K!!0h%F{TsHR~@$6y0;Y%CVJJqkgFWs4YS5uQQR
z5fL9tQP_+D9_xz?r;%xr;z7Ia1S%!U6*?0rj6_<^&L=48fG$v)z_(a3**!^Y5q2UV
z3TAhkcImO<;T?(F=+3)5)x)T>3h@OtEu9)B7|&7OyOK`uWO~)@Tr$|nxu#69AFT##
zHaJDqOb?b}$SEkA^J&mqN1tA~E_Vk46tPtl{$oMbvTe|FBf~DW2PbsW&3~fRG-aCd
z%@21Ap&gj4Tt^n5Prj%vE|Kh)^$0!jqE<JDyS3N<!Z=DoKly&GP?w3&;(C2afpc@z
zyPQ7vmS>LaODV9XN(}`tx<u4V!S9dSy|r^(Af(F=p`t2z%&XH!kAiPHSA)UI2E6YY
z0qy7Nq1A>R7Ux0<z^IhHS}Mz~ZXQO|6`{;Lkg!ab!e~)K4w(VZY8!Ew9vSp5Q{}cO
zk}afHpVpVtmG@ynxBQ7#<;l>ct=MpLu>)0_zyCR{#4nM>3`wHwJ1^^gdg=41A(Q)y
zALUOU#G}c-^_A1VJmr~7Ee}HweCIB2;r!XSpT6hk3w$h{so{uTO-ml}&U3(d$;7O9
z=a_S)?R(lXdgckwimUWQ7ar1<)CsSE6lael_o?)MqAqpWZ);^8fC~1Pvc^t8Y3ASz
zhQqEIMZWAQA<7CsfwNTXPSp}ad)GR%LIuUbf@Y(wy|rm`_QlU?FL^0=w^nZ7&thV~
z<DoenzB#3NR8MUWYhS#^b%P6Ms_ic5{5t;%y2ax!rQ1HE)n?~DqTN%<qOs31uvE@g
zr43*orBHANN<osAYk)y8`GI`N3`XJ(k)R{=gUFV6C+sJ3-T=ZC1%<=>7g7RMhU`e<
zy0RulA`5X{NyU6Y+mM_Xq=rSFs(FylyI7STR)y&FW=vaL?~KZ9#Xn)Ljt&lSnmjl}
zm+ynN`RFrRAsa&TS2P6EiC!t~v#k-XCCcj<yh`U5>Gkx~<0z21@KNL-k9zzC^heL4
zXzF=gpO-E8Q|&?jEdSxZJ)^Cn&}UFS_x)!eXB<zWfG5R9>XWrv&6L9~mM*p}Q3Zuu
zC9!}hZ*738qp(0naW0c&i_{3_>Hwj{tU_Da>j-&2Xbz_$xzdSNo(vnPaO)%Nc_R|S
z9f=Gua&^tB<`5eLsq8teviV=*pi%N8C>-ml^7t0NqpL%g+x&IZQv~?FZg>jj&Tw^_
z{#;9Ht9Z6HrVu`#i92x)EH{9je4no>d*Ls&>>2_7daM#*X+^pqVu*P-L?|wTN^tVK
zhJ2IMLne`cI*di8J(CshVhAx@gx(Jw+yfGq;2rj}BUp<KhIRlWN2@$l{^1^v^{-pQ
zUOv735oD<6zoAvP=gr1mlG}B&B`*pT5JNPRlAo`smUNXE$e2>D;EDe7SDMja_oK>%
zWO!w4+pZE_c?N0Uhexn;;;GA?BIfZf9w3s*03gUFqJD`B9s$}h?7D;&z`j^c_yJa&
zn*&cGmyb9xzH@a-erY7C7Nmx9oC~42l}G|qvEPd1IkpZ?#8t-qu8%>0hQ^YyPENpM
z!vcS`26AW|Q;SQ?XfrmXA~=Wc*jniabt7-Wn;F9N9hB*NPZd+!`@M})f8pb*Z+f8K
z*We9D>FIi3SgK#>^?F|;9se1e`O{0Z!bO}}2`W=yl%rQcek`p*A)<{Wb<71F^lXI>
zTc*+3PhRpYl+JJu8}Bhhu0xe+-k{ZJDK%^bwZE)YOrO2Kh?aa=TOw5+$**YpRk_D&
zm`B-V&r&`{g8uV-UzvZDtp=EGBi<^x_$)4ZM(MQ$zNOUFtX0W#*bPzaXDn<oXj>(u
z&-^9`79{w~d|c5$*Kg5krQy3Od}Sr0VcxWStbY=zUV1d3)luCa`by{`M>L)cXodHM
zAPG@1GIxu;1uw{3hK-h$Q0M7P$Q%Nc)FB64BqQD@7Yn1p$}X2!*<zfgJC}jIKk_pe
z=;vP6E3)^$p?$(%;#39&ql0vEiMQ&$pK0~J7A_5nZ%16^tk<`1A-=Ky4F84;C30m)
zt;QyL#N(@@vn_C4r+!ECuTdT&MDvWMTqebRFfAsM0fh2Y9Tlzx=&2_GqmS<K)zepW
z-+WrH`R<XrGZcAPIX30n%_;}sjm_*-ix9@1S5?{PW_dT2206&LB@jzs|4jg;E4)ib
z66|1)T<*KE7r8!T%1-X#1dS1M;6%<JU<t!pS5~&<Rhk@I=?srGDmD5F_(wK~Vc{Hn
z2+OWF*NFw_>!4Nc!aMDucsZ@!kJD9}fYT5@Yz8Yq8yp{!939+r$?@Zga*Ppnr8{>4
zdabX*`#L`C{g_>)@vqvfBjqMb)MlOQw_t07C_$$p<3D`IPIj;E+kJCUvmra=L7Vrd
zJd5ZH5#LV6`*!g~q2^T71(XCbK>a-LrbpZXrUyzg5aM7PcogM^T!3u}VcAq6I7dI6
z^GC315-5-qEj&9ZUkgs4B4gOeUm&)gNTB8jOw?>lp#&}5WY;y>Jz**dHhW}mS$YB<
z2cL++<3l#FzERr55>)Bo-I-CYO@pbB4%;&nm8Zx^wZnSc?PPhyrAik_p<zdo4`<o(
z&WE#b#jpL0f$#|jnSwH~bVyg~^@f|_PKjA{DzGB3DX=0kn%s<fgAV>2%kale{x~cj
z8~NkOu>`)HJ~D6=At?6%0UQR?8E{4f8`F;?zF;|yDUijW>{u-;+tlxC@loV}www+p
zv7K~s#8*ZiAM$;&-C2G&1Bth%pu){QvBs`b<~6aqj_$f+e4I(KYf-#6jryNJ!PJkB
z`E(zzluj=7ROr&0#67t3tj|Z!^`goW4dJy^VFx8UA66R}>&xlQV$VF<`XO%-eRjw<
zC%bLf*B##m%Gr(LHrAvTRppefOaHM?fO3Br6wanHWol4Qfv0*g6Q7DrVR2mb17bO_
zcPDE{@a#9f;cKO$WqO#-wCX0cehJ3Z)VC1{{P<fCfQP=}`!GG+jIERNUh*u-wtmyM
zYz{L<ub48h`4EGM!op#u5V2vMCLmOv!8rx0I4G!g6S9DWk$^HHn@-RbM+mS3gu4)P
z5{aB-1bzZXR3d`_HBWey0gxW+Pa~Fc9kb!~o;~0yg!0^7sgnl!kqtu;kDS5NXw49U
zSWY=;%o$sZ($w_1UsUn>{PgxeK}A3Q0bd18yaEaE+CO_r3bBDQal*uoTG_~O{D&T2
zQ7Sx;P7Oin@s5bf5_|^XsEaiEif09#{*bT4Z(VqDwO%^~v1-{VZj;F+I1m_z(_)!F
zmMN996y57nk~TC70RW)`%_`@iuyhFkN?aMputG6p5Pv3-`2^ojMfhk4D1vClRUQGj
z1E4Uoa5@p561rfC-^?*tHr^EYT%-aCsmwaL<DL~a+TVQxdtx~21lW|KN%#>QWDVbH
z?3iI1z?TIfuq0GRr?~qXL~#l)24YoAMFVMKDY!scKVt4YlthHY1&$aKkyM<CN@QY~
z8aBYy=deZ*C}X?Wr}Whd-$D&vX<nl@NYB5f6)tvevg77_v7)Lu-(&jsep;|5hdmyL
z&tjSR04@bwm<^_z?tRo>K^Onn<16KGFRv1`y~UvN-}Y84blZ`zAla0(d!&Z1dKQRX
z`1*?|zC>AVVMy&Ellr;qV9kP|?5G*YhObDt440V{rteHHq;u7pZ}o)QKn7LKZFo!z
zuaFhcGQ2xeLg0J{Mm20|Y?Ju_b`)Pah(HM&uzt30^K96%WbsTJmQR7Y&<4*I(qRtW
z^=;oG#|mC1f%P41N@DHmXc}t{J3wf1BRCy7x|r?K0KK<OFI1MU)m^~pi8@~L%&*Kn
zl<QdHJ+>i@fDUX}WzAn)?yDA~xc<v9GQYdar;J=Nr`dqMV4Ks*)Ze#JEA=t?(<fi@
zEt3b?M5eF5<Xb3{$}@vY*bJ6Y&s_90@`pl&<5jEZ`ajdLBeVv&KnXV4u$f;Afd`%&
zji5{sHS3U0y!)DuJfgjSi#*GFH~I_xsux9o7i#=-`z_L$MPN2ffva;~kX??c%<g_R
zO}Jc}{XO2m!oCx`PLgnn2==iTl(zpNoV%CbkN6%JK{LrOP>dsvU9Nj7-viNThtW!D
z$zq(GH1`iRV{@)~uC=76(kG%YpRB`!f+jPY>9#@4CMsX08}z+bJX?fov-FCuyI$;V
z1j``d4jtSJYY4Ti*bXNp=qm4XoNM4<fC7Fa`5SqpS_L#MA_ee1F6nWkW)jAArpYxq
zEjywaNDZVrIY|UVD-Atp;$SBDh+%`1Lp=hUO|0_S;I+HrI1{rO(pAtu9L|Fv;*dYH
z5X&VAp}4ItOj+`U_x?~{H6Jq`J!X|S1;itvCp>!fy??JS(Z*6STIJE}=kdA_DGW@Q
z{roZ8?a_~U?Og2vE<3>~6kWZCt*Jxsr^Jkeg2!TztHyMWvuknOf>+qMK{jGTZ$f8I
zI8pVyO-b05Z6YHG6JY>GjzryfbjY=MA|5iE<cji6z{ujKSdN1-pRmsBq-NpXALt8L
z^YFX|4qEeHS-5;TYHh-Dp6atgh4=nQuU%!wA@~_6`l~<DB^C8NPIaEk!w;zo^nj)>
z_c7e*F-_m&V*<#&t?6Z+l|l;#BNGruaO4$kB;mqEAgB#V9kH*{gs#_DG7z}A)xMWu
zLiIXg!nf(V%I>S4dM3DFgZJ>bd&1SDxD310ZAhxc3p8_6+0V7rvpSHgTxx<2!my^D
z(|y=@YMEk(O_k~}$T#IE0IT5L8WTvhgi-ozqn2^*$b1m3iJBC*>IGflBnXE+S}cZX
z61gH<@);njSpBX-JatOKI_T35)Q+iitxQg~ADihG0Xee`lDVvQRN4pMc(aOZ!hnLG
z$k}A9FL^aN&<JI@Kx?@bsUw9J+2QO6?82W?@R<p1yFW&u(=TUM7y+`$JMXHR*D<--
z1d6bl0RzfY&$-@gJh~s9LiQB$t-+=l{tO`THSR5q1vSaaFcZ~lt}jIrHvQ+8ZnKA*
zFr4KxsaouF6hSD|89PK`1Hp}4p(RAjhfz6zB#;TW9h)S1zmOCZZ)OPwo7;}IBRqdx
z=6xKY;S|h#cVEZt#O868&qu%_9vQ?@ixBsgh3^O|HsYb`;O2sPSW5B;?#`q-jBnVT
zT9V5Vt4c~EaQEFlt#-;7z`+MOxhE$?h0@|`a`g%qMDvM{L8;Nh4o#*;{(&w~9jSCa
zPAlt)q#(a}yEV!w#u*^ua6m=Jz#OBja(E~Xw!^=+&PU;+A<-2MKye?z$!c1xP%L8>
zIS;UdV4nfTQ(@8p_LL~2rwaA90`>VQwS5I=KE7U{m+%o|a_k9-B`8tFA4Wapa-EZ0
zyk)B*KctS8<Lm@B;x_V-_-dyWC6O`2w8&Bw1}82s6C|WOO$c`=EOj;X^as5Qafnp;
zVtpx1)cWV@!V8i+sS@JAK1Gl<A_z8F(+e-@6+XU4iBdfE++i=yLGZ&2y7?qhCNKJ-
z;W?5|zw+z5*jOs%y#qL1ObIl)r2v^du`B9V;5?Nwzo%G5^!F6$3+YOmUhY9z8t**9
z4yJi?Z6U5A_H^cc41|45I{oxt5Su*rDZN;7_(ErNrd?k`zbw*st0)roFU_N#VqAOR
zX`BQ1{dszc-8ToAkY!QD?T>EMDi+!NXvM|tuVBySV%q+)Z;3WA)J)}%z^ni3&8S|R
z^PpbLrVE=8pmY_*gTofZj!Tvb28ZC3JmgO-M#WlDZkV-`m3h)lvz&*57cCwRAD;-*
zcT#zXV{!BVS4&7A(O2Z`c?S@4k{ZOef|%qmEvq01yn-44W}v}z_&!~)tOhb{p~Yym
z;Y-_f?DM)&*E_0If4~_R9<q3n_)+#LUH^hc|1?*xpx56-fZ$BC?gt2^6}|U<oRlbd
z`B;&D9SzP?h&W6KiV<mO+=7P~<N*KK4!!D~fxY+*t=6~67#QMm!d+!D0KQrp9B1wn
z>+hE=4+~_uaUDL`1*+EeJGrj-EZa3lKjiguYZUHXSfMSLKU>t(+de4z2TFB05$7Gm
zr)7+?@K7?e5%L^oS7vyN9v`!qFFYMF$1b`sk&r3`(q0Y*LsLo>5vMV5gYy=1n0Qt(
z+aX$$sP$LXT47`Gb5IlxBZRe0lj1<;+dAP}Lv#|~VJfhGC|QcIYWrOMll1*Q5bpXz
z+EQ$_O<>156oZ@k?3gzDEw)fZDsaH$=(m!WEFOjEtmI?vU}ASiZUHH_Z@$JK7@E3@
zjLesAe2|K3Hzk*&IV14GM9j`;^qb4SBGj{q092u#elSeVtwB*VW6fdeNIDcvi^epf
zqwGR}fsoP5d184nDMmBz_FuOKBrAj=0Tk-|h_8BzU6`H&y?w};Au^W_l}HA@$!ygz
z6D(+Er{QJ+#p(iw9OW9>K*4tPPWoA=uY6O)r5SK_hGvLJnn^?z2rd$~7QyLBD=r2>
z-84fElsWNVR9v#ype1Dx2p_s1drd_uRL#>5(7-(ChCAo!*VDy$`ZCCZpUu;E(uUP~
z`5Lv`D8Izm7QvQ8woIX1Nv9fP`5Rh!FH4L3hg}fh=NU5j4cs|bG;n&iuV=A>o8%Az
zB}J@E5A1F$EXIhItRv1O5SGZ*Y;sh~j^M&T5W)qCvEiibrW|o`FZTI>@9ORY<-sqN
z2iTS!ptXOl)$L{zBA*T<CNhIX7_C>i?y4T73tN$^kvgCcyy#n6KBEH^9Q?_Pz7YNN
zMI49t#C#l@cDB*$D-)hqCm}-$tZbpOn?04;GZp%WJcZ1PELiEI6;RCm&00mdl0=RT
z4ei<R2DCYjP^+RQZ0VgE7}_(Q!-WlRcRpIJ!oH*QPwt5sbiq@w)@|Q$KY=m|oXrC0
zAK=0V_`ccN1^V&1*!sbhX-HE-t!~e-jiNrwIV`-Z0EwTm0W+8<b%Jq(Mddh!I7IXe
zoaC_`yAydAY&2}bnKL+jt-x}Q=|UKQ`}$J7`HRbR6dUFZhgrktLtQFLVO$)I5`Z+H
z$%p7fBn9)sjD>&#oMt}gL~&<!qlz_xauT=76&O~y2BeFQK&7%<|1ewcoIpS&zQjdl
zb|m2>2_GwPfgSj4DTy~Dr)f^a@V)}Xp(KZ4B@Ga3Z0q+{E=Qg079*dIkqaM0(LS7U
z{s2$r2wi_ttEkA~rBj^`gdA~wJt}P2v_#a(zcbfjcDT%58Y^jQwT^D%VGz?v0{teH
zt%A}=DrT;jpcTw=3ea6(Ri=qn`tBOUm=9cslb*}#^#wHVe|d}|b3$!08KiCh%Tpy)
z1<P5&aOgnI%ci0u(W7o*Oby@mRZSoJc>zNTeXye&u(mZa(W<K*JnqHKuy5b^DvsXf
zGPoI}#)I)`a3a@i%3?|GdajZKRaOOq3OnN=aWW*9$&QA6fU{8$u)?-VarGrsv^G!p
z3s3PW^)+(-!%9RLZAqBRiFO@2cn~{ia_J3rvgFW+`|k42X|i21rszS%vr;l61qduK
zBX~~+&ZrJepS-cQ1=Jr=Tb)pQgBsRM$W9J00);D-@r0eRC(^EXcKIn=NOLq&;=B)+
z`<ijSBcF7F_ZP^zJGd4D0H>$wk;Rr;3=S0|f^0}c_*%i^^YeWbex)U)7(<1Wzl^J%
zh^rcd`{HVhVjka`MPy8Cpmi0fN<6z!E0j^V4r5WoRfoZF7I@hCiSj1M?5hN%5sNQ%
z5vv`HMvPkIw!R4ASf!WXPrwIIZ8^-#GW>-q<Se+fgCo1j1M6lr<LVKII^%dONwwr%
zp3QF-ItDrLMcen_C>qpxRMWN=<k^n%iL6&%)_r8WuItk+KSfFB2lS=c%`5Z=q_+By
zoT9cCIE8Nmy(xLTXk4=GoL=Q{gselI9LYT0Z%!s)Nl8u|3RGkis70~5s<&d>76v)a
zDCBfK!tgj62nkCgxTbxh8iL20nmi^sR4cy8{Le?McgwK$t3+78SdxLGr7Xl+-Pv@U
zbbV}lA8+vP>%~1BOKv}*lFJ}<>@mW*AEvrv9iQERyBc!OIMf657k$9DoIF9j)0MR2
zZa~UBnN6;F*@s)vyb0gJO0>b!*}Y`B%`ps=Ejx)Z8V|z%Iv3Qt=;C`(DKoc2E1@3;
zfgJJCLF_3?HtFs3@D{DoujWhT&mr``X(ycLGgq{t>Cl^n^zIt(F7?O-oYO>)t<>9u
zi4xy~y@05GRZfbo0SO75R;^O&<z?`XMP3SqID5?vHx>NgzE|P&d}tpW?VxHU?A}zm
z1FA-f$^i}_R%J6B`Ca119d%+>ML4Bi&4$iA<Xh0{bjCE?BI!N%EI73nb{&3o8Ylkf
zKa>L=mFVh0EW}L~ryTXj1Omqkl!FGm(M_#cQ4Vfc({K?FH&8}M&kZ~Ixbz(D@GX(v
zn>TajdD$XQ1>Ti%u2v6nP^6UpwpO3xS2H3GUeJTh`g<gC^~+{`t9;lP(yx;bza7#$
z>2Ve}pa0ez`l}H7NPY|HpPz@|qVshLqELMp=3dQ0y`;jTH=YCRDp?Yp{j%0bAG{qJ
zsVC&|#Tk?1w%P$E*Ktvp8$#oo5r8lwC)|65tnO?;T#Y*1a6-2hTynHg>(GXs=C=_#
zgA$4yRM45QURNw~jS0`7%guUii+i9PDcE?xm8Lv0$o`kGzFgy7i*@v#li;BB-}Y@(
zp}PAIX+e7K+r9$?!CO=%<#A%ZT3&-VbX2w&!IiV$@D;4Z@@@A`0_u{FhlIepvS7<e
zpf<><Csg*NB8GSbp!3TE-U@b7MdI<E6G%P0C;%E$tT)~Vg{;0hPzgn2u-#B1A~gm|
zo^n;KLy?S#oTa1ke#-B>N|EH^|NBLfY>-f6rLUf?09UpcvBWvRw+%kp{*p>RS8!b<
zJFMbDxXUEDw(`08z7l;DXO50i`9i%ycmhhdbawG$gUi*0!e)~QmXNseLHX9iHIh|M
zQRIeMMUg<EoDpT&IcmQIid<Ah0Hc-5A&cp$Hhnw2)dp5v+OD_I0Y29Hwst*0_qXGa
z>Sx;Z)%3G=J?up_u(2A>_O8|XiaOi5u^lCsBV7K5wtN`ZU4)l&ml)mr;{u&@;rc$i
zvF&^12D7ga2CJpf)p`j#e~7@~RNgZWz%rhOAI~$s{Q=DQcbDl!mW!pv!Fy3~KoFb9
za-^1RAOD~9vNX6^^xjLp>g=V}`W_E0UF4~($^aLbhI>*lbEs`tt60U=9#ZikM5boU
zS8|X-v4<3p2I%}EDDCGT)Ef)=3GS5|Liz&KQC+_l$CYz*I6JmhH?*ma{!WAwVZ_M!
z>Vs^}AobSK(%<RC62SktF;MXV+eSsdcshA}8?dU;5&AuZbVf(Cv)d`Y=C@~bv_w1Y
z%m-_bh~eYiUG)40y{eJ3fhf%tA>xijNF|qqo$1sDy?&0!6g-W@5q*4v9$YqS7SPWq
zeN;7DI7*-Qj?v$3&|fQnjAhN7eQu-vve&P^NkMt`GadRT*LCgY$Qj2xV2klvXxQ;&
z7ZQirAhuu`dOf>)T96Xw(ghBnsq*iBdG{6!HM-}$-fH^2UwVq?s}~Nq-(W{Qag-WA
z@`PvZKAh|Ur;iW(js=hGkf-^)B9wR@R$~X@@#e1Q-klX}I*R-&^60_fk@05i%NaD0
zbbQ5IK^H#jDQxFc!ugttoT)d3NztV7XIU1(DRzCuh_&8d7JwY94sCKh1n|jQ#Sn((
zhtzAp@RYh9o0KPL-xqyzafFc}b&5!+x?a@Bxj$%#E-S!@Z09(qFUOe{$2lJuw2myr
zvED+S!#RWGG<iPisktWXetZwk;XIw)oYw!c;d)jRZllUJY%KMmOu6649Jb6En%V>>
z{<F16^&Bt7&dxRW>WyrV_~;|0{$e_QuYN|hY5wS5q?Vp7f~i?^AAU97r`OalDEMcl
zK};`vSg$(*l`a^OlstSW`#U?QyqO3wakanFGR4sm6slt~J6y)L4W4ydH+1(e@v4k@
zf1np>xI^dOLe<vUD`iyjpkCydlx}<G9WC8QKd4pzIz#6552B3e`5JHCmOSY9AS^A%
zK#lTd36%UeyQ0={RW?HPyz?&K*r{0o(V`HQvvg(}y)bvE+~cjw&LMqS!3;wO2L<81
zWAuqbc+mnZodx_NgyrHuqSRE5sC_4^hj;5#{eN@g-*0Y|=9wGWhEM5hJe4`4V1_wx
z6iE!;>8{Ms*$UpJZ#KD=&+L}A;)k{h+n*gHU`{sjfPPDuYQ6$*V%xKNafRBah+R~J
zUH1DJvXB3jzPpf~`Wt;wp*>-`^fx-{MJ#;*k=if9IfEDg3O~(YfVWZQz5W%!1-kni
z`ZkjC>R8ZUNI(0UKEK%M<23!m^j2oy{JMT!VFOc~dKZoLwxXS;RVQruZ`Ac2{o^r~
zClCXomJkO;P>Bz2fIX=^YD7lCQ>t75xpV|laJn5FJ+2Xu+L}b%5gh17wtmh$^Z<P@
z`%Q-F1-xFaN;YvfSu)*u-7ek#b-Wtpjptxg@OIXzUYrt^_a<KFln*uGF7^5agk9}f
zt6FfJZxBH&K%8Z4IpcTkiL)TNN#3H#xn({D+C6P~wSs762_rySP9aEY@5}~3B2dFh
zr@@hs!f&aI<Fa0NKiz1Cnl+S_;8jV^krR?B%y}Oy8?TC(CbeNj-deI|EOU)UIX$L)
zXMU9fNS|NXK~FvHS=8?KOWS8=4X-*dy-@6{tegGLp>fy;ZLO`X^r?Gb@wS%u{j~o(
zdc7`KriR~!-(B{quD2;Ggz>e9w-G}(TR2wd_s>QpMGCN)nfqdvspTpH1v;2&2v{kE
z*&F2mQoM@R!86XS<o8gCeZjSPDA;4-a-%^;N7*pEL%Tx`n%NtOaZ<9o1S>j3KYR#T
z86=Ocu@I|tV<s$T1MJs4pF<sUU9Pb(sA7Q4592Ib-gZ3is<*MJwo<`OHc_wnpjK7E
z1dwYi7@+HaiftF+Piuw8$D6M5GO2MZ_rlWv>}3x&zt39s@*o5)ujztqie!-`5)efk
zm9&VxuR?8dhcU|Au&*}RrBl{+Y{85jvcqUy+<ORoBuQk!lJlNS4%f3`EW9XZwJX+C
za)r+ePV;Uq=@MOGLx;S7mB~ZVg2Q-b45m2jYSd8~&m!x3A&zrhmRv#^#_iwIE3DTn
z@+)6XIh1ovqyXwTqkXZjF#Eml=#>()b?sG`cS3S5$`UuSbp>zBz`H2%0&qT9gw1^M
zIm9^T0tsHay$Ix*tewO#^kM8HPHVx&-WvdwfP)?o-sJad8o?=cA0XDSfkK2C!_)2z
zo(#g<93a8IDfJp3yElF+m!ai`n3QwutO!1N=d9fo?@)p1DEkI21o4&%OOP?k;ti)V
zC50}hZ-My6DwcEVjWUwtL2Ks~qttc@d2fChPxUok#zXg9f*Z3NmebTVNyi?W_aOgT
zeAuh{wP=C!nTHS71U3jQgxGz_DRi>w94`m6a3;K?&LT~>z_&}cNYp;v!kgP9;05i9
zD3@$<vO8iy#aP5h66qhcULne0-++CV!VY*BxfxT?XWf3xf%iUsU*AqtO79W6f;f;^
zJHKAFflrhurQI9+b63C90}Tz%YoEdjtn&IN8oQ(~DOF+%XWa04nN<HQ92T3K4tHL&
zSB{8Y^QJS$pDcht`}QS-<3DsskCuXX@w#__jX9H!U($p3{T%{_+b-+X*@nydUmy3r
z9M1mJcK^j?eJv|-s4&-X$A__J1V<!X^&A%t3remnm!ccM3Fk-`Ls5khjVgxfbWT#C
zlkf2_tAWZ}z8L|+p$t;hn+-7Eh<u`_pTy?-O^^BCM^|3;FQgB?>8~qB6{*~AUvux~
zf`wa7=k=F+yA*(7RkPs;KE%N|F6<sT!~&Mif78E~O3(W1>0@L5EmXFvpqw7)EhwR5
z!~QY~f6*V9oBtS{`J%t2%(Vj5PvWQkMp{}@P*;e|f0!3cU#%@LvOgN~-?<bAM6bkl
zHdfb;cy~@%V1Ota!FeGi!-QV{g1@T71__fb9edUPpS^2a>HLlUnoi6r|EXWI^8ChB
zURkh+esx^|N;8fXETg};+dtRSO6R`s-$)x@fTeIYTri(5PWVgc@IU+8s@5d&ZmC&A
zQt3bXYw5M$@h@e-&8JI83aaSJD17XVUqBz{yZwvkyZ_=Zs#<;Z$DjR2G&uVwXkYOq
z|9txB!~W9wjHMZKH6HP=sz((fZzH?PESPxdt7rWyEApRHi1F+%sJm}(L4f}J<NhW0
zW((%hmh}b2^uV9`=QuNWqZ~7@qNi{7SCuomY?P?JzP_tKA$h^9Nrw3Cj+ggiJqHQI
zw5`|QMCU&V=o~I9K=lek=iFP+X~`Q48t9%bT$}p=e^H6kKR+Hh<gf5-po_o249=a0
z=~wVIf9aYvt;qb%9uJG&G$QH68Q_wc-1!B6^))8>!at(>e4uBeAMr=A=W-=>uvqFH
zrXb!#VmL2W7waDU1m?%FT~d+Z9H}Hpbg>tpy149<sZ}Kg?01T}c8%KaX0sHTk_aq?
z)}x9859eM*)LbkfTaiw=tCsly>CfrfO-4I?K2Wfz()u1s3=JV}h4*i@CvVF>f3N?w
z1trdlj^K&V#kPXwbm?>c9~9vm_loUN_pB>ul=p)OY%U!HL4LXdf*^UIpeXyyL;jn4
z=;b&3b)c`LHM%W>+GzW{f`wE#>Mt)Hh4SZ0T<{8_yJvpouZK6NOc7=ABynauWT$G;
z){16yaa+LxI`cLL1e<N5&rkXnWtY6^Uxj0CR^rer>{DeM0>_o1rkqQ~VRi8Z77IC_
z&rwTk67g9pa=r!HF&^YF4!(dILiOrb91e<u7o%}?$h2&xRHCUrg5WLceo(L<o5G%P
z*gvpPv5krQ!5fdbn3dl=c0+U!MWcw+BJGpLK{gIXk?6*%)NT%bW2&-bSh(Bo9^;;1
zM{y+#JX}eSBT9<uMRpL3_58RHME?|uy*I(A3g)^OWMOqp#!>*JSKx69(_pBFER`V>
zU`g+8k~_{20Z~_TWUEraP$(mBN|G}MbAx63iVHS2s(n!_aTY8ayAfo?v5gk*gp!KP
zeCtlVn?SB1JpoIP{U1P5w$Jji`G@@%HXx-LFMv0!AUG`trbJ~|s>3ny$%)7gRANIv
Y@S|M){%-(CYxcv<1qExpzx7-H8>#>JI{*Lx

delta 2545
zcmZ`*dr(x@8SlO4oO@xHcX%suSixNc0ULSxDq?`B6UcxDqZF^pg<W0tF83}%CJ-2s
zsgL?z<<pF&woxWpBN*zOsjUJLZK5`yV^beV#F%Dk8ebXPSTjz079UBb)BDGn@0@eb
zchC3zzTfY=e;lTpPb6%nV$F@imYLSRQQN!WzRUS3zCTZk_ifI@eSa%xkM)IYmwj2q
z!M+jI{PtffOuhkctdDMq_LXlB>ML2EUhGTU81LKg&H`W7R$JfT{_G&%#lO3J8MhLA
z9XDuSBKv1P3aui2F?SP?Z__=wZ`HjSMQqC~;WB1Z=L&PC!)P6rAfZ+Y0n#hP!v1#Q
zIE4OE2!`Kgi)L|hCY#(ToOzKYd@N{f%)Cr&35PrFk_;1cQHCsCjD*HWA=+eQINf$v
zQ>|)1zb3}R-3KI!?a{>@QE<9gnhOIOO2yQ<ssO@0C<X?GNdQ<&q%g<|#gRZ)^Xc%*
zIIJsH41m+?#Ph6jy|}2JEf7#Pg5KLmW}O7>L-4yml)@eaB5Ne8N<=SXSeA^Qhbzgb
zoMoq=hG#)sAV$HrRVWcMuZm{KUyLH7tre=hNmr>`^Qu<bmQJmH3r2sAqI^Glh}r4I
z=$erC0$($zLs{j2kv18s?p7L9`gzATYB;oJs?a*c>Go2~b8fr-ipQ(gjybeI;VmI9
z-=)}9hvuqPb?S5*UR9~3S{?N|RBGWKEVMx}R*p?wTD{XvJ&M=i|Avv_yOtXTBQK#)
zIP^Nddi4?%0JoQ-K&W4g;zF%I{@B=^S!gwSCLD%}rFp&)0slC+mH_Hi>Wu=bg0cuF
zbp4)$!Jfk;jD6aO{w0oq@xO<XAf-f#c#1{P_osF@qXS_uv<-EH&^GGP)hTsOm&=ry
z2}`%5tY~U0^6IX%3Wu}Kn^s62ns=r8N-A5w9YqOH+D?L4=}xp)gpgh6r{I|*1+XQ%
zkt`$It0w5&i{`@Vy~rZArNYB*6vy`LL+=Spdk0mRS;rCdz8T6sK@wS|xSCW59YD!2
zI)pOe=uH#`pS_R5A?cDB3*{$K5N=DIZUV<ilmX+1Py+P&Hx>;c8_d6hVqxYWGO@H%
zXi$JRPa-pTK0wt%D!cyyIye=2zDD!F^d0(=5rof*P&$e%@L;_Z3Xa>nKr7yoiv1-o
zL7RlXg~?w?(Qr`4UGUXWVuF!OjM<q0d?48DtfRIhPjhW5r4XJ*qTyN$o(MZLNjOW4
z#Yd#Epzlq<xlp|c$&izX$2|$3-K5xq*y?2b(X{V*(CWiEY{oL&DZwlU-r}cfJfuI5
z!ywbZCg@!)uK9oDk^<9zSO#%Vow8{SxOAyV+hEh{!g#oJ3MazAhd2d3I)js-_cV@$
z`+vgEu(-208lzPDDwK`j%dGJ{E_XAvkSrG9))_&9qC#R}N9T|i%<y3`3WhtU1etwT
zMZ6PWZ40qMRSOA+Gc6=OdaT}Snsld?^X|#S#jdrG8W9e+5(;0ol00NMz0A@^!h}$6
zsdOf_*)>-MH(}#zBqp?gTCJ%WUftPXOQo%?zNyvGaCHsg`jsnT>*LqUn`<denmLoY
zn_MnBo9aur558DU>DYOewU)exAQDIf)Bp*ANgK#~&^M4o*t&sKLf~p{rLQI-*sFOx
zkhGJR&TBhKG7N0wP+!?dI@!ieq)dePt;7ulYe_cr_{cW+s*6Yb#A`6Pft2~ZPJpX^
zD{BX_K;;fn#5_C690b)Xd8+Jhku?IlyoWS~6lP}9$1JA`zqjh<VR9w1yPVvdVmND6
z4yHqO)AF*4N~#!CbF0*=D{e!vd!3p)1J3r45~waDIc#1p*(Sh|H*f?CJ4zl3@GBEZ
zhXuz-KJqi<&@nO&;wy0+YyTWC5THFwlpAb{-L5rpWpiovm0FWGl{yXT(G0`6+@(^7
z%9YcrX=6g@(KU}!uW*3)H57hDRnblK@x$Y2Pz^(=SE<hBjVqzop}5CHuU>Vly3<ZA
z%}|&wM#>iMQ8BzQD_pFEkOLfw>-}UZ#14=m__T^Ado-1=UAm65VA~+M5^UGFrc$-V
zqv_sqxRxtfVAmwBY=`!d0O`>(9GgVqz<GkqgFl=gvq2o<*e)C*vmot~7y|o;ND2fc
z@IKSiO(ghYh}WmtMv^lhJN5HcSG`TTd-_;Fel|bd%5bUfdM?;AXb$vW$MNDq0|pDE
z7`XcvDN;0<;9L)hW+SJFj9_=MGzB_-jWFbBXdH~Lz`<~D1x|;3YsB#oQX-k4dze^Z
z#6LV3CRs3Lgrq@xiIfDxFJT#eF+wIn{W%g0&FA<Alu9-@R>q~Y{yce6fQ$>g*lMow
zST|fCW{7OV<JhqagdnugP@(%Gu_ZSsZVrMzhFGoYQaM~!n)VbYKU`M$<|4Vt{&9(1
z6v3sTSoZHvNM{Z^9wqfB!M@9!Az$b60C%<Wb`+W?O@y30Y2Bk#p3jr0KX<0CeE!=I
zkuODB{POE}`$PjdMJboUALeb#e@KjV%5ufNvdKg3ircQbT)c()+p9-0jAl)*9V;{5
zYxV7o{8wbRA;@t27EfP)zBI}F2pnGbyce9S5h7W^bSYV8Jl&H7)>ta7$YAl!(sR6d
zZjuOlw?mp801;~?ALI|BAQrtviWK1E4k;H7`J^IP_NElk)g=W(7)aIZHz0`$`iVV}
zb>EjplG%PLcTZ&3=gW0w_H31WBMQ1TIj-w~90dJS`LOJ&91rdDWCEY*av<y}=fgU;
fe2~4Z$&1RtW0nJ1{Ge<JW<A4lk%h5uWR(41+Sh>#

diff --git a/index.html b/index.html
index 679eb43..5cb65c0 100644
--- a/index.html
+++ b/index.html
@@ -45,6 +45,7 @@
     <symbol id="i-key" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="m21 2-9.6 9.6"/><circle cx="7.5" cy="15.5" r="5.5"/><path d="m21 2-2 2 2 2-3 3-2-2"/></symbol>
     <symbol id="i-user" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></symbol>
     <symbol id="i-printer" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="6 9 6 2 18 2 18 9"/><path d="M6 18H4a2 2 0 0 1-2-2v-5a2 2 0 0 1 2-2h16a2 2 0 0 1 2 2v5a2 2 0 0 1-2 2h-2"/><rect x="6" y="14" width="12" height="8"/></symbol>
+    <symbol id="i-pin" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 17v5"/><path d="M9 10.76a2 2 0 0 1-1.11 1.79l-1.78.9A2 2 0 0 0 5 15.24V16a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1v-.76a2 2 0 0 0-1.11-1.79l-1.78-.9A2 2 0 0 1 15 10.76V7a1 1 0 0 1 1-1 2 2 0 0 0 0-4H8a2 2 0 0 0 0 4 1 1 0 0 1 1 1z"/></symbol>
     <symbol id="i-paperclip" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21.44 11.05 12.25 20.24a6 6 0 0 1-8.49-8.49l9.19-9.19a4 4 0 0 1 5.66 5.66l-9.2 9.19a2 2 0 0 1-2.83-2.83l8.49-8.48"/></symbol>
     <symbol id="i-download" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></symbol>
     <symbol id="i-empty-vault" viewBox="0 0 120 120" fill="none">
@@ -121,7 +122,7 @@
                 <svg><use href="#i-unlock"/></svg>
                 Unlock
             </button>
-            <button id="passkeyBtn" type="button" class="btn btn-ghost btn-block">
+            <button id="passkeyBtn" type="button" class="btn btn-ghost btn-block" style="display:none">
                 <svg><use href="#i-lock"/></svg>
                 Use a passkey
             </button>
@@ -266,6 +267,7 @@
                 <svg><use href="#i-search"/></svg>
                 <input id="searchInput" type="search" placeholder="Search…" autocomplete="off">
                 <kbd>Ctrl+K</kbd>
+                <div id="searchHistoryMenu" class="search-history is-hidden"></div>
             </div>
             <div class="topbar-actions">
                 <div class="view-toggle">
@@ -311,6 +313,24 @@
                             <svg><use href="#i-edit"/></svg>
                             <span>New note</span>
                         </button>
+                        <div class="dropdown-sep"></div>
+                        <div class="dropdown-section">Templates</div>
+                        <button class="dropdown-item" data-new-template="credit-card">
+                            <svg><use href="#i-key"/></svg>
+                            <span>Credit card</span>
+                        </button>
+                        <button class="dropdown-item" data-new-template="ssh-key">
+                            <svg><use href="#i-shield"/></svg>
+                            <span>SSH key</span>
+                        </button>
+                        <button class="dropdown-item" data-new-template="server">
+                            <svg><use href="#i-globe"/></svg>
+                            <span>Server credentials</span>
+                        </button>
+                        <button class="dropdown-item" data-new-template="recovery-codes">
+                            <svg><use href="#i-shield"/></svg>
+                            <span>Recovery codes (note)</span>
+                        </button>
                     </div>
                 </div>
                 <div class="user-menu">
@@ -647,9 +667,12 @@
 
             <div class="slideover-field">
                 <div class="slideover-field-label">Account</div>
-                <p style="font-size:12px;color:var(--text-dim);margin:0 0 8px">
+                <p style="font-size:12px;color:var(--text-dim);margin:0 0 4px">
                     Signed in as <b id="settingUser"></b>
                 </p>
+                <p style="font-size:11px;color:var(--text-faint);margin:0 0 8px" id="settingVersionRow">
+                    PMServer <span id="settingVersion">—</span>
+                </p>
                 <button class="btn btn-ghost btn-sm" id="changeMasterBtn">
                     <svg><use href="#i-lock"/></svg> Change master password
                 </button>
@@ -711,6 +734,8 @@
                 <span>Master password</span>
                 <input id="reauthPassword" type="password" required autofocus>
             </label>
+            <p id="reauthError" class="is-hidden"
+               style="margin:8px 0 0;color:var(--danger);font-size:12px"></p>
         </form>
         <footer class="modal-footer">
             <button type="button" class="btn btn-ghost" data-close>Cancel</button>
diff --git a/js/app.js b/js/app.js
index fe8a879..f223a4c 100644
--- a/js/app.js
+++ b/js/app.js
@@ -15,6 +15,8 @@ const API = (location.pathname.indexOf('/password-manager/') === 0)
 // Falls back to navigator.clipboard for the standalone PHP frontend.
 const prefResolvers = {};
 const fileSaveResolvers = {};
+let versionResolver = null;
+let launchModeResolver = null;
 const folderPickResolvers = {};
 const fileWriteResolvers = {};
 const fileListResolvers = {};
@@ -408,6 +410,54 @@ const Bridge = (() => {
             cmd('cmd://tray/notifications?enabled=' + (enabled ? '1' : '0'));
         },
 
+        // Hardcoded build version surfaced from the Delphi host. Promise-
+        // based with a 2s safety timeout — if the host is unreachable the
+        // resolver fires with '' rather than hanging the UI.
+        getAppVersion() {
+            if (!active) return Promise.resolve('');
+            return new Promise(resolve => {
+                versionResolver = resolve;
+                cmd('cmd://app/version');
+                setTimeout(() => {
+                    if (versionResolver === resolve) {
+                        versionResolver = null;
+                        resolve('');
+                    }
+                }, 2000);
+            });
+        },
+        onVersionResult(v) {
+            if (versionResolver) {
+                const r = versionResolver;
+                versionResolver = null;
+                r(v || '');
+            }
+        },
+
+        // Was the app launched at Windows boot (via the HKCU Run entry's
+        // -tray flag), or did the user double-click the exe?
+        // Returns 'auto' | 'manual' | '' (bridge offline).
+        getLaunchMode() {
+            if (!active) return Promise.resolve('');
+            return new Promise(resolve => {
+                launchModeResolver = resolve;
+                cmd('cmd://app/launch-mode');
+                setTimeout(() => {
+                    if (launchModeResolver === resolve) {
+                        launchModeResolver = null;
+                        resolve('');
+                    }
+                }, 2000);
+            });
+        },
+        onLaunchModeResult(mode) {
+            if (launchModeResolver) {
+                const r = launchModeResolver;
+                launchModeResolver = null;
+                r(mode || '');
+            }
+        },
+
         // Open an http(s) URL in the user's default browser via ShellExecute.
         // Delphi validates the scheme so a malformed entry can't smuggle a
         // file:// or custom handler.
@@ -436,6 +486,10 @@ const state = {
     trashed:   [],
     trashedCount: 0,    // server-side count, updated separately from state.trashed
     folders:   [{ name: 'All', color: '', icon: '' }],
+    // Index in filteredEntries() of the keyboard-focused card (j/k nav).
+    // -1 = no cursor. Cleared on view/search change so it never points
+    // outside the current list.
+    cursorIdx: -1,
     view:      'all',        // 'all' | 'favorites' | 'folder:<name>' | 'tag:<name>' | 'trash'
     search:    '',
     selectedId: null,
@@ -776,12 +830,22 @@ function faviconHost(siteRaw) {
 // network doesn't break the user's flow.
 async function saveEntryIcon(entryId, dataUri) {
     try {
-        await fetch(API + '/entries/' + entryId + '/icon', {
+        const r = await fetch(API + '/entries/' + entryId + '/icon', {
             method: 'POST',
             headers: authHeaders({ 'Content-Type': 'application/json' }),
             body: JSON.stringify({ icon_b64: dataUri || '' }),
         });
-    } catch (e) { /* silent */ }
+        if (!r.ok) {
+            // Surface the server's reason so silent persistence failures
+            // (size cap, auth) stop being invisible bugs.
+            let msg = 'HTTP ' + r.status;
+            try { const b = await r.json(); if (b && b.error) msg = b.error; }
+            catch (_) {}
+            toast('Icon NOT saved: ' + msg, 'error');
+        }
+    } catch (e) {
+        toast('Icon save failed: ' + (e && e.message || e), 'error');
+    }
 }
 
 // Fetch + save the favicon for one entry. Updates state.entries in-place
@@ -1296,6 +1360,19 @@ function openTotpTool() {
     modal.querySelectorAll('[data-close]').forEach(b => {
         b.onclick = () => closeTotpTool();
     });
+    // Esc dismisses. Capture phase so it beats other listeners (e.g.
+    // the keyboard cursor handler that also intercepts Escape).
+    const escHandler = (ev) => {
+        if (ev.key !== 'Escape') return;
+        if (modal.classList.contains('is-hidden')) {
+            document.removeEventListener('keydown', escHandler, true);
+            return;
+        }
+        ev.stopPropagation();
+        closeTotpTool();
+        document.removeEventListener('keydown', escHandler, true);
+    };
+    document.addEventListener('keydown', escHandler, true);
 }
 function closeTotpTool() {
     document.getElementById('totpToolModal').classList.add('is-hidden');
@@ -2084,6 +2161,89 @@ function parseTags(s) {
     return s.split(',').map(t => t.trim()).filter(Boolean);
 }
 
+// ---- Search history (last 5 unique queries, localStorage-backed) ----
+// Survives across sessions but not across port-changes (localStorage is
+// origin-keyed). Acceptable: stale terms don't outlive a server restart.
+const SEARCH_HISTORY_KEY = 'searchHistory';
+const SEARCH_HISTORY_MAX = 5;
+
+function getSearchHistory() {
+    try {
+        const raw = localStorage.getItem(SEARCH_HISTORY_KEY);
+        if (!raw) return [];
+        const arr = JSON.parse(raw);
+        return Array.isArray(arr) ? arr.filter(s => typeof s === 'string') : [];
+    } catch { return []; }
+}
+function pushSearchHistory(term) {
+    if (!term) return;
+    const t = term.trim();
+    if (!t) return;
+    const list = getSearchHistory().filter(s => s.toLowerCase() !== t.toLowerCase());
+    list.unshift(t);
+    while (list.length > SEARCH_HISTORY_MAX) list.pop();
+    try { localStorage.setItem(SEARCH_HISTORY_KEY, JSON.stringify(list)); } catch {}
+}
+function removeSearchHistory(term) {
+    const list = getSearchHistory().filter(s => s.toLowerCase() !== term.toLowerCase());
+    try { localStorage.setItem(SEARCH_HISTORY_KEY, JSON.stringify(list)); } catch {}
+    renderSearchHistoryMenu();
+}
+function clearSearchHistory() {
+    try { localStorage.removeItem(SEARCH_HISTORY_KEY); } catch {}
+    renderSearchHistoryMenu();
+}
+function renderSearchHistoryMenu() {
+    const menu = document.getElementById('searchHistoryMenu');
+    if (!menu) return;
+    const list = getSearchHistory();
+    if (list.length === 0) {
+        menu.classList.add('is-hidden');
+        return;
+    }
+    menu.innerHTML = '';
+    const header = el('div', { class: 'search-history-header' });
+    header.appendChild(el('span', null, 'Recent searches'));
+    const clearBtn = el('button',
+        { class: 'search-history-clear', type: 'button' }, 'Clear');
+    clearBtn.addEventListener('mousedown', ev => {
+        // mousedown not click — blur on the input would hide the menu before
+        // a regular click reaches the button.
+        ev.preventDefault();
+        clearSearchHistory();
+    });
+    header.appendChild(clearBtn);
+    menu.appendChild(header);
+    list.forEach(term => {
+        const row = el('div', { class: 'search-history-row' });
+        const item = el('button', { class: 'search-history-item', type: 'button' });
+        item.appendChild(el('span', null, term));
+        item.addEventListener('mousedown', ev => {
+            ev.preventDefault();
+            $('#searchInput').value = term;
+            state.search = term;
+            state.currentPage = 1;
+            renderGrid();
+            pushSearchHistory(term);   // bumps to top
+            menu.classList.add('is-hidden');
+        });
+        row.appendChild(item);
+
+        const del = el('button', {
+            class: 'search-history-del', type: 'button', title: 'Remove',
+        }, '×');
+        del.addEventListener('mousedown', ev => {
+            // mousedown to beat the input blur that would hide the menu first.
+            ev.preventDefault();
+            ev.stopPropagation();
+            removeSearchHistory(term);
+        });
+        row.appendChild(del);
+        menu.appendChild(row);
+    });
+    menu.classList.remove('is-hidden');
+}
+
 function allTags() {
     const set = new Set();
     state.entries.forEach(e => parseTags(e.tags).forEach(t => set.add(t)));
@@ -2187,8 +2347,10 @@ function renderSidebar() {
         // folder being reordered above/below this one.
         item.addEventListener('dragover', e => {
             e.preventDefault();
-            const types = e.dataTransfer.types;
-            if (types.includes('application/x-pm-folder')) {
+            // dataTransfer.types is DOMStringList in some engines (no
+            // .includes) and frozen string[] in others — normalize first.
+            const types = Array.from(e.dataTransfer.types || []);
+            if (types.indexOf('application/x-pm-folder') !== -1) {
                 // Compute insert position based on mouse Y vs item midline.
                 const r = item.getBoundingClientRect();
                 const before = (e.clientY - r.top) < r.height / 2;
@@ -2310,9 +2472,18 @@ async function addTagToEntry(id, tag) {
             method: 'PUT',
             headers: authHeaders({ 'Content-Type': 'application/json' }),
             body: JSON.stringify({
-                site: e.site, title: e.title || '', username: e.username,
-                encrypted_password: e.encrypted_password, iv: e.iv,
-                folder: e.folder, tags: tags.join(','),
+                site:               e.site,
+                title:              e.title || '',
+                username:           e.username,
+                encrypted_password: e.encrypted_password,
+                iv:                 e.iv,
+                folder:             e.folder,
+                tags:               tags.join(','),
+                kind:               e.kind || 'login',
+                totp_secret:        e.totp_secret      || '',
+                totp_iv:            e.totp_iv          || '',
+                custom_fields:      e.custom_fields    || '',
+                custom_fields_iv:   e.custom_fields_iv || '',
             }),
         });
         e.tags = tags.join(',');
@@ -2323,6 +2494,9 @@ async function addTagToEntry(id, tag) {
 
 function renderGrid() {
     $('#contentTitle').textContent = viewTitle();
+    // Re-apply the keyboard cursor after the grid re-renders. Defer one
+    // tick so the new cards are in the DOM before we query for them.
+    setTimeout(applyCursorHighlight, 0);
 
     // Audit log: read-only chronological feed, custom render.
     if (state.view === 'audit') {
@@ -2949,6 +3123,91 @@ function isPasswordAged(e) {
     return passwordAgeDays(e) >= limit;
 }
 
+// ---- Keyboard cursor over cards (j/k + arrows) ----
+// Stays inert when any input/textarea has focus, when a modal is open,
+// when an open slideover would steal Enter, or the user is mid-edit.
+function handleCardCursorKey(e) {
+    if (e.ctrlKey || e.altKey || e.metaKey) return;
+    const tag = (e.target && e.target.tagName || '').toLowerCase();
+    if (tag === 'input' || tag === 'textarea' || tag === 'select') return;
+    if (e.target && e.target.isContentEditable) return;
+    if (!$('#appShell') || $('#appShell').classList.contains('is-hidden')) return;
+    // Don't fight focus when a modal is up.
+    if (document.querySelector('.modal:not(.is-hidden)')) return;
+    // Slideover open: Enter would commit Save, leave it alone.
+    if ($('#slideover') && $('#slideover').classList.contains('is-open')) {
+        if (e.key === 'Escape') return;     // handled elsewhere
+    }
+
+    const list = filteredEntries();
+    if (list.length === 0) return;
+
+    const goNext = (e.key === 'j' || e.key === 'ArrowDown');
+    const goPrev = (e.key === 'k' || e.key === 'ArrowUp');
+    if (goNext || goPrev) {
+        e.preventDefault();
+        let i = state.cursorIdx;
+        if (i < 0) {
+            // Bootstrap to the first visible card on the current page,
+            // not the very first filtered entry — otherwise pressing j
+            // on page 3 would send focus to page 1.
+            const start = (state.currentPage - 1) * state.pageSize;
+            i = goNext ? start : Math.min(list.length - 1, start + state.pageSize - 1);
+        } else {
+            i = Math.max(0, Math.min(list.length - 1, i + (goNext ? 1 : -1)));
+        }
+        state.cursorIdx = i;
+        // If the new cursor lies on a different page, flip to it. The
+        // re-render reapplies the highlight via the deferred call in
+        // renderGrid.
+        const targetPage = Math.floor(i / state.pageSize) + 1;
+        if (targetPage !== state.currentPage) {
+            state.currentPage = targetPage;
+            renderGrid();
+        } else {
+            applyCursorHighlight();
+        }
+        return;
+    }
+    if (e.key === 'Enter' && state.cursorIdx >= 0 && state.cursorIdx < list.length) {
+        e.preventDefault();
+        openSlideOver(list[state.cursorIdx].id);
+        return;
+    }
+    if (e.key === 'Escape' && state.cursorIdx >= 0) {
+        state.cursorIdx = -1;
+        applyCursorHighlight();
+    }
+}
+
+function applyCursorHighlight() {
+    document.querySelectorAll('.entry-card.is-cursor, .entry-row.is-cursor')
+        .forEach(el => el.classList.remove('is-cursor'));
+    if (state.cursorIdx < 0) return;
+    const list = filteredEntries();
+    const entry = list[state.cursorIdx];
+    if (!entry) return;
+    const node = document.querySelector(
+        '.entry-card[data-id="' + entry.id + '"], ' +
+        '.entry-row[data-id="' + entry.id + '"]');
+    if (node) {
+        node.classList.add('is-cursor');
+        node.scrollIntoView({ block: 'nearest', behavior: 'smooth' });
+    }
+}
+
+// Human-readable label for an entry template id. Returns '' for unknown
+// / unset templates so callers can fall back to the kind-based defaults.
+function templateLabel(tpl) {
+    switch ((tpl || '').toLowerCase()) {
+        case 'credit-card':     return 'Credit card';
+        case 'ssh-key':         return 'SSH key';
+        case 'server':          return 'Server';
+        case 'recovery-codes':  return 'Recovery codes';
+        default:                return '';
+    }
+}
+
 function folderLabel(f) {
     if (!f || f === 'All') return '(no folder)';
     return f;
@@ -2970,6 +3229,10 @@ function sortEntries(list, by, dir) {
         }
     };
     return list.slice().sort((a, b) => {
+        // Pinned entries always float to the top regardless of sort. Inside
+        // each group (pinned / unpinned) the user's chosen sort applies.
+        const pa = a.pinned ? 1 : 0, pb = b.pinned ? 1 : 0;
+        if (pa !== pb) return pb - pa;
         const va = get(a), vb = get(b);
         if (va < vb) return -1 * mul;
         if (va > vb) return  1 * mul;
@@ -2998,7 +3261,10 @@ function buildKebabMenu(entry) {
     const menu = el('div', { class: 'entry-kebab-menu' });
     const isNote = entry.kind === 'note';
     const items = [
-        { lbl: entry.favorite ? 'Unfavorite' : 'Favorite', ic: 'i-star', fn: () => toggleFavorite(entry.id) },
+        { lbl: entry.pinned   ? 'Unpin'      : 'Pin to top',
+                                 ic: 'i-pin',  fn: () => togglePin(entry.id) },
+        { lbl: entry.favorite ? 'Unfavorite' : 'Favorite',
+                                 ic: 'i-star', fn: () => toggleFavorite(entry.id) },
         { lbl: isNote ? 'Copy note content' : 'Copy password',
                                  ic: 'i-copy', fn: () => copyPassword(entry) },
     ];
@@ -3117,6 +3383,14 @@ function renderCard(e) {
         // Compact mode: single kebab menu replaces fav + dup + del
         head.appendChild(buildKebabMenu(e));
     } else {
+        const pin = el('button', {
+            class: 'entry-pin' + (e.pinned ? ' is-on' : ''),
+            title: e.pinned ? 'Unpin' : 'Pin to top',
+            on: { click: ev => { ev.stopPropagation(); togglePin(e.id); } },
+        });
+        pin.appendChild(icon('i-pin'));
+        head.appendChild(pin);
+
         const fav = el('button', {
             class: 'entry-fav' + (e.favorite ? ' is-on' : ''),
             title: 'Favorite',
@@ -3147,10 +3421,14 @@ function renderCard(e) {
     const isNoteCard = (e.kind === 'note');
     if (isNoteCard) {
         // Single placeholder line — the body is encrypted client-side,
-        // we don't decrypt it eagerly for every card.
+        // we don't decrypt it eagerly for every card. Template-typed
+        // entries surface their specific label so the card reads as
+        // "Credit card" / "SSH key" / etc. rather than the generic note
+        // copy.
         const noteRow = el('div', { class: 'entry-note-row' });
+        const tplLbl = templateLabel(e.template);
         noteRow.appendChild(el('span', { class: 'entry-note-placeholder' },
-            'Encrypted note · click to read'));
+            tplLbl || 'Encrypted note · click to read'));
         // Same crypto pipeline as a password — copyPassword decrypts the
         // body and drops it in the secure clipboard.
         const copyBtn = el('button', {
@@ -3472,8 +3750,12 @@ function renderTableRow(e) {
                 td.appendChild(avatar);
                 const nameWrap = el('span', { class: 'cell-name-wrap' });
                 nameWrap.appendChild(el('b', null, entryDisplayName(e)));
-                if (e.kind === 'note')
-                    nameWrap.appendChild(el('span', { class: 'kind-badge', title: 'Secure note' }, 'note'));
+                if (e.kind === 'note') {
+                    const tplLbl = templateLabel(e.template);
+                    nameWrap.appendChild(el('span',
+                        { class: 'kind-badge', title: tplLbl || 'Secure note' },
+                        (tplLbl || 'note').toLowerCase()));
+                }
                 if (e.favorite) nameWrap.appendChild(el('span', { class: 'fav-dot', title: 'Favorite' }, '★'));
                 td.appendChild(nameWrap);
                 break;
@@ -3485,10 +3767,11 @@ function renderTableRow(e) {
             case 'user': {
                 td = el('td', { class: 'col-user' });
                 if (e.kind === 'note') {
-                    // Notes have no username — show a faint "Encrypted note"
-                    // placeholder instead of the "—" mask the login path uses.
-                    td.appendChild(el('span', { class: 'col-user-note' },
-                        'Encrypted note'));
+                    // The badge in the Name column already advertises the
+                    // type (NOTE / SERVER / SSH KEY / …), so the username
+                    // column stays empty here — repeating "Server" twice
+                    // adds noise without information.
+                    td.appendChild(el('span', { class: 'col-user-note' }, ''));
                 } else {
                     td.appendChild(el('span', null, displayUsername(e.username)));
                     if (e.username) {
@@ -3605,9 +3888,22 @@ async function batchMoveToFolder(folder) {
                 method: 'PUT',
                 headers: authHeaders({ 'Content-Type': 'application/json' }),
                 body: JSON.stringify({
-                    site: e.site, title: e.title || '', username: e.username,
-                    encrypted_password: e.encrypted_password, iv: e.iv,
-                    folder, tags: e.tags || '',
+                    // Re-ship the full payload — partial PUT would wipe
+                    // TOTP / custom_fields / kind / template (see also
+                    // moveEntryToFolder and the "places à toucher" list
+                    // in CLAUDE.md).
+                    site:               e.site,
+                    title:              e.title || '',
+                    username:           e.username,
+                    encrypted_password: e.encrypted_password,
+                    iv:                 e.iv,
+                    folder,
+                    tags:               e.tags || '',
+                    kind:               e.kind || 'login',
+                    totp_secret:        e.totp_secret      || '',
+                    totp_iv:            e.totp_iv          || '',
+                    custom_fields:      e.custom_fields    || '',
+                    custom_fields_iv:   e.custom_fields_iv || '',
                 }),
             });
             e.folder = folder;
@@ -3633,9 +3929,18 @@ async function batchAddTag(tag) {
                 method: 'PUT',
                 headers: authHeaders({ 'Content-Type': 'application/json' }),
                 body: JSON.stringify({
-                    site: e.site, title: e.title || '', username: e.username,
-                    encrypted_password: e.encrypted_password, iv: e.iv,
-                    folder: e.folder, tags: tags.join(','),
+                    site:               e.site,
+                    title:              e.title || '',
+                    username:           e.username,
+                    encrypted_password: e.encrypted_password,
+                    iv:                 e.iv,
+                    folder:             e.folder,
+                    tags:               tags.join(','),
+                    kind:               e.kind || 'login',
+                    totp_secret:        e.totp_secret      || '',
+                    totp_iv:            e.totp_iv          || '',
+                    custom_fields:      e.custom_fields    || '',
+                    custom_fields_iv:   e.custom_fields_iv || '',
                 }),
             });
             e.tags = tags.join(',');
@@ -3767,9 +4072,80 @@ function renderBatchBar() {
 // Edit-in-place state for the slide-over
 let soState = null;
 
+// Pre-fill bundles for common entry shapes. Picked from the new-entry
+// chevron menu. Each template seeds title + customFields + (for notes)
+// the body — the user fills in the actual values. Crypto pipeline is
+// unchanged: the fields go through the regular AES-GCM custom_fields
+// blob like any user-added field.
+// Helper lists for template dropdowns. Built once so each template
+// reuses the same array.
+const CARD_BRANDS = ['Visa', 'MasterCard', 'American Express',
+    'Discover', 'JCB', 'Diners Club', 'UnionPay', 'Maestro', 'Other'];
+const MONTHS_01_12 = ['01','02','03','04','05','06','07','08','09','10','11','12'];
+const NEXT_15_YEARS = (() => {
+    const out = [], y = new Date().getFullYear();
+    for (let i = 0; i < 15; i++) out.push(String(y + i));
+    return out;
+})();
+const SSH_PROTOCOLS  = ['SSH', 'SFTP', 'SCP', 'rsync over SSH'];
+const SERVER_PROTOS  = ['SSH', 'HTTP', 'HTTPS', 'FTP', 'SFTP', 'RDP',
+    'VNC', 'Telnet', 'PostgreSQL', 'MySQL', 'MongoDB', 'Redis', 'Other'];
+
+const ENTRY_TEMPLATES = {
+    'credit-card': {
+        // Note-kind: site/password aren't required for cards. Card
+        // number goes in a labelled field, not the password slot.
+        kind: 'note',
+        title: 'Credit card',
+        body: '',
+        customFields: [
+            { label: 'Cardholder name', value: '', is_secret: false },
+            { label: 'Card number',     value: '', is_secret: false },
+            { label: 'Brand',           value: '', is_secret: false, options: CARD_BRANDS },
+            { label: 'Expiration month',value: '', is_secret: false, options: MONTHS_01_12 },
+            { label: 'Expiration year', value: '', is_secret: false, options: NEXT_15_YEARS },
+            { label: 'Security code (CVV)', value: '', is_secret: true },
+            { label: 'PIN',             value: '', is_secret: true  },
+        ],
+    },
+    'ssh-key': {
+        kind: 'note',
+        title: 'SSH key',
+        body: '',
+        customFields: [
+            { label: 'Key name',       value: '', is_secret: false },
+            { label: 'Fingerprint',    value: '', is_secret: false },
+            { label: 'Hosts',          value: '', is_secret: false },
+            { label: 'Protocol',       value: '', is_secret: false, options: SSH_PROTOCOLS },
+            { label: 'Passphrase',     value: '', is_secret: true  },
+            { label: 'Private key',    value: '', is_secret: true  },
+        ],
+    },
+    'server': {
+        kind: 'note',
+        title: 'Server',
+        body: '',
+        customFields: [
+            { label: 'Hostname / IP',  value: '', is_secret: false },
+            { label: 'Port',           value: '', is_secret: false },
+            { label: 'Protocol',       value: '', is_secret: false, options: SERVER_PROTOS },
+            { label: 'Root password',  value: '', is_secret: true  },
+        ],
+    },
+    'recovery-codes': {
+        kind: 'note',
+        title: 'Recovery codes',
+        body: 'Paste your one-time recovery codes here, one per line.\n\n',
+        customFields: [
+            { label: 'Service',     value: '', is_secret: false },
+            { label: 'Account',     value: '', is_secret: false },
+        ],
+    },
+};
+
 // Open the slideover for either an existing entry (id = number) or a
-// brand-new one (id = null). opts: { presetTitle, presetSite } pre-fill
-// the corresponding fields for the new-entry path (Ctrl+Shift+A hotkey).
+// brand-new one (id = null). opts: { presetTitle, presetSite, template }
+// pre-fill the corresponding fields for the new-entry path.
 async function openSlideOver(id, opts) {
     opts = opts || {};
     const isNew = (id == null);
@@ -3778,6 +4154,20 @@ async function openSlideOver(id, opts) {
 
     state.selectedId = isNew ? null : id;
     if (!isNew) touchEntry(id);
+    // Templates: resolve a preset bundle of {kind, title, customFields,
+    // body} and merge it into opts so the rest of this function sees a
+    // pre-seeded new-entry payload. Only applies to fresh entries.
+    const tplId = isNew ? opts.template : null;
+    const tpl   = tplId ? ENTRY_TEMPLATES[tplId] : null;
+    if (tpl) {
+        opts = Object.assign({}, opts, {
+            kind:           tpl.kind         || opts.kind || 'login',
+            presetTitle:    tpl.title        || opts.presetTitle,
+            presetBody:     tpl.body         || '',
+            presetFields:   tpl.customFields || [],
+            presetTemplate: tplId,
+        });
+    }
     // Resolve kind early: opts.kind for new entries (login default), entry's
     // own kind for existing. Drives the field layout below.
     const kind = isNew ? (opts.kind || 'login') : (e.kind || 'login');
@@ -3793,9 +4183,14 @@ async function openSlideOver(id, opts) {
     const body = $('#slideoverBody');
     body.innerHTML = '';
 
-    let plain = '';
+    let plain = isNew ? (opts.presetBody || '') : '';
     let plainTotp = '';
-    let plainCustom = [];
+    let plainCustom = isNew ? (opts.presetFields || []).map(f => {
+        const out = { label: f.label || '', value: f.value || '', is_secret: !!f.is_secret };
+        if (Array.isArray(f.options) && f.options.length > 0)
+            out.options = f.options.slice();
+        return out;
+    }) : [];
     if (!isNew) {
         plain = await decryptPwd(e.encrypted_password, e.iv);
         // Decrypt TOTP secret if present. Empty string when no TOTP configured
@@ -3831,10 +4226,15 @@ async function openSlideOver(id, opts) {
         // Working copy of the custom-fields array — mutated in place by
         // buildCustomFieldRow handlers. The serialized JSON of this array
         // at Save time is what gets encrypted into custom_fields/iv.
-        customFields: plainCustom.map(f => ({
-            label: f.label || '', value: f.value || '',
-            is_secret: !!f.is_secret,
-        })),
+        customFields: plainCustom.map(f => {
+            const out = {
+                label: f.label || '', value: f.value || '',
+                is_secret: !!f.is_secret,
+            };
+            if (Array.isArray(f.options) && f.options.length > 0)
+                out.options = f.options.slice();
+            return out;
+        }),
         originalCustomJson: JSON.stringify(plainCustom),
         originalEncrypted:      isNew ? null : e.encrypted_password,
         originalIV:             isNew ? null : e.iv,
@@ -3842,6 +4242,10 @@ async function openSlideOver(id, opts) {
         originalTotpIV:         isNew ? null : e.totp_iv,
         originalCustomEncrypted: isNew ? null : (e.custom_fields || null),
         originalCustomIV:        isNew ? null : (e.custom_fields_iv || null),
+        // Template identifier — propagated from the entry on edit, or
+        // injected by the template picker on new. Sent back to the server
+        // on Save so the card/table can label it correctly.
+        template: isNew ? (opts.presetTemplate || '') : (e.template || ''),
     };
 
     if (isNote) {
@@ -3907,6 +4311,15 @@ async function openSlideOver(id, opts) {
                 : document.getElementById('soSite');
             if (f) f.focus();
         }, 50);
+    } else {
+        // Edit mode: focus the Title input so the user can start editing
+        // immediately (especially when opened via Enter from j/k nav).
+        // Defer so the slideover transition finishes first — otherwise
+        // the browser may steal focus back during the animation.
+        setTimeout(() => {
+            const f = document.getElementById('soTitle');
+            if (f) { f.focus(); f.select(); }
+        }, 80);
     }
 
     renderGrid();
@@ -3984,16 +4397,35 @@ function buildCustomFieldRow(field, idx, rerender) {
         soDirtyCheck();
     });
 
-    const valueInput = el('input', {
-        type: field.is_secret ? 'password' : 'text',
-        class: 'so-input so-custom-value',
-        placeholder: 'Value',
-    });
-    valueInput.value = field.value || '';
-    valueInput.addEventListener('input', () => {
-        field.value = valueInput.value;
-        soDirtyCheck();
-    });
+    // Render a <select> when the field declares an `options` array (set
+    // by entry templates for things like card brand or expiration month).
+    // Falls back to a plain <input> otherwise. Storage shape unchanged —
+    // `field.value` still holds the chosen string.
+    let valueInput;
+    if (Array.isArray(field.options) && field.options.length > 0) {
+        valueInput = el('select', { class: 'so-input so-custom-value' });
+        valueInput.appendChild(el('option', { value: '' }, '-- Select --'));
+        field.options.forEach(opt => {
+            const o = el('option', { value: opt }, opt);
+            if (opt === (field.value || '')) o.selected = true;
+            valueInput.appendChild(o);
+        });
+        valueInput.addEventListener('change', () => {
+            field.value = valueInput.value;
+            soDirtyCheck();
+        });
+    } else {
+        valueInput = el('input', {
+            type: field.is_secret ? 'password' : 'text',
+            class: 'so-input so-custom-value',
+            placeholder: 'Value',
+        });
+        valueInput.value = field.value || '';
+        valueInput.addEventListener('input', () => {
+            field.value = valueInput.value;
+            soDirtyCheck();
+        });
+    }
 
     // Reveal eye — only meaningful for secret fields.
     const eye = el('button', { class: 'icon-btn icon-btn-sm', type: 'button',
@@ -4004,9 +4436,12 @@ function buildCustomFieldRow(field, idx, rerender) {
     eye.addEventListener('click', ev => {
         ev.stopPropagation();
         if (!field.is_secret) return;
+        // No-op on <select> — it has no type=password equivalent.
+        if (valueInput.tagName !== 'INPUT') return;
         valueInput.type = valueInput.type === 'password' ? 'text' : 'password';
     });
-    if (!field.is_secret) eye.style.visibility = 'hidden';
+    if (!field.is_secret || valueInput.tagName !== 'INPUT')
+        eye.style.visibility = 'hidden';
 
     // Secret-flag toggle (chip-style) — flips both the storage flag and
     // the visible input type.
@@ -4341,13 +4776,55 @@ function soFolderField(current) {
 }
 
 function soTagsField() {
-    const wrap = el('div', { class: 'slideover-field' });
+    const wrap = el('div', { class: 'slideover-field', style: 'position:relative' });
     wrap.appendChild(el('div', { class: 'slideover-field-label' }, 'Tags'));
     const cont = el('div', { class: 'chip-input', id: 'soTagsContainer' });
     const input = el('input', {
         type: 'text', id: 'soTagsField',
         placeholder: 'add a tag…', autocomplete: 'off',
     });
+    // Autocomplete dropdown built lazily on focus/input. Pulled from
+    // allTags() and filtered against what's already selected + what the
+    // user is typing.
+    const suggBox = el('div', { class: 'tag-suggest is-hidden', id: 'soTagsSuggest' });
+    function refreshSuggestions() {
+        const typed = (input.value || '').trim().toLowerCase();
+        const matches = allTags()
+            .filter(t => !soState.tags.includes(t))
+            .filter(t => typed === '' || t.toLowerCase().includes(typed))
+            .slice(0, 8);
+        suggBox.innerHTML = '';
+        if (matches.length === 0) {
+            suggBox.classList.add('is-hidden');
+            return;
+        }
+        matches.forEach(t => {
+            const item = el('button', { type: 'button', class: 'tag-suggest-item' });
+            item.appendChild(icon('i-tag'));
+            item.appendChild(el('span', null, t));
+            // mousedown beats the input's blur so the click registers
+            // before the dropdown is hidden.
+            item.addEventListener('mousedown', ev => {
+                ev.preventDefault();
+                if (!soState.tags.includes(t)) {
+                    soState.tags.push(t);
+                    renderSoChips();
+                    soDirtyCheck();
+                }
+                input.value = '';
+                refreshSuggestions();
+                input.focus();
+            });
+            suggBox.appendChild(item);
+        });
+        suggBox.classList.remove('is-hidden');
+    }
+    input.addEventListener('input', refreshSuggestions);
+    input.addEventListener('focus', refreshSuggestions);
+    input.addEventListener('blur', () => {
+        // Delay so a mousedown on a suggestion gets handled first.
+        setTimeout(() => suggBox.classList.add('is-hidden'), 120);
+    });
     // Render existing chips inline (renderSoChips() would no-op here because
     // the container isn't attached to the DOM yet, $ would return null).
     soState.tags.forEach((t, i) => {
@@ -4368,6 +4845,7 @@ function soTagsField() {
     });
     cont.appendChild(input);
     wrap.appendChild(cont);
+    wrap.appendChild(suggBox);
     input.addEventListener('keydown', e => {
         if (e.key === 'Enter' || e.key === ',') {
             e.preventDefault();
@@ -4378,10 +4856,14 @@ function soTagsField() {
                 soDirtyCheck();
             }
             input.value = '';
+            refreshSuggestions();
         } else if (e.key === 'Backspace' && !input.value && soState.tags.length) {
             soState.tags.pop();
             renderSoChips();
             soDirtyCheck();
+            refreshSuggestions();
+        } else if (e.key === 'Escape') {
+            suggBox.classList.add('is-hidden');
         }
     });
     return wrap;
@@ -4470,7 +4952,14 @@ async function soSave() {
     const totp  = isNote ? '' : (($('#soTotpSecret') || {}).value || '').trim();
     if (isNote) {
         if (!title.trim()) return toast('Title required', 'error');
-        if (!pwd)          return toast('Note body required', 'error');
+        // Template-typed notes carry their data in custom_fields, so an
+        // empty body is fine as long as at least one field has a value.
+        if (!pwd) {
+            const hasFieldValue = (soState.customFields || [])
+                .some(f => (f.value || '').trim() !== '');
+            if (!(soState.template && hasFieldValue))
+                return toast('Note body required', 'error');
+        }
     } else {
         if (!site || !pwd) return toast('Site and password required', 'error');
     }
@@ -4511,11 +5000,20 @@ async function soSave() {
     // stored ciphertext so the row's updated_at doesn't get bumped for nothing.
     const cleanCustom = (soState.customFields || [])
         .filter(f => (f.label || '').trim() !== '')
-        .map(f => ({
-            label: (f.label || '').trim(),
-            value: f.value || '',
-            is_secret: !!f.is_secret,
-        }));
+        .map(f => {
+            const out = {
+                label: (f.label || '').trim(),
+                value: f.value || '',
+                is_secret: !!f.is_secret,
+            };
+            // Keep the dropdown options so the field re-renders as a
+            // <select> on next open (otherwise it would silently degrade
+            // to a free-text input after the first save).
+            if (Array.isArray(f.options) && f.options.length > 0) {
+                out.options = f.options.slice();
+            }
+            return out;
+        });
     let cfEnc = '', cfIv = '';
     const curCustomJson = JSON.stringify(cleanCustom);
     if (cleanCustom.length === 0) {
@@ -4538,6 +5036,7 @@ async function soSave() {
         custom_fields: cfEnc, custom_fields_iv: cfIv,
         folder: fold, tags: soState.tags.join(','),
         kind,
+        template: soState.template || '',
     });
 
     try {
@@ -4903,8 +5402,40 @@ async function duplicateEntry(entry) {
                 // decrypts the same way as the source.
                 custom_fields:      entry.custom_fields    || '',
                 custom_fields_iv:   entry.custom_fields_iv || '',
+                // Carry the cached favicon / custom icon over too. Plain
+                // text data URI, server-side cap applies.
+                icon_b64:           entry.icon_b64 || '',
+                // Carry the template identifier so the copy keeps the
+                // same card / table label as the source.
+                template:           entry.template || '',
             }),
         });
+
+        // Copy attachments. The source's encrypted blobs are keyed to the
+        // current vault key, so we just download → re-upload (no re-encrypt
+        // needed; same key on both sides).
+        if (r && typeof r.id === 'number') {
+            try {
+                const metas = await api('/entries/' + entry.id + '/attachments',
+                                        { headers: authHeaders() });
+                for (const m of (metas || [])) {
+                    const full = await api('/attachments/' + m.id,
+                                           { headers: authHeaders() });
+                    await api('/entries/' + r.id + '/attachments', {
+                        method: 'POST',
+                        headers: authHeaders({ 'Content-Type': 'application/json' }),
+                        body: JSON.stringify({
+                            filename:       m.filename,
+                            mime:           m.mime || 'application/octet-stream',
+                            encrypted_blob: full.encrypted_blob,
+                            iv:             full.iv,
+                            size_bytes:     m.size_bytes,
+                        }),
+                    });
+                }
+            } catch (_) { /* best-effort — copy may end up partial */ }
+        }
+
         await loadEntries();
         render();
         toast('Duplicated: ' + entryDisplayName(entry));
@@ -4958,17 +5489,40 @@ async function toggleFavorite(id) {
     } catch (e) {}
 }
 
+async function togglePin(id) {
+    try {
+        await api('/entries/' + id + '/pin', { method: 'POST', headers: authHeaders() });
+        const entry = state.entries.find(e => e.id === id);
+        if (entry) entry.pinned = entry.pinned ? 0 : 1;
+        render();
+        toast(entry && entry.pinned ? 'Pinned to top' : 'Unpinned');
+    } catch (e) { toast(e.message, 'error'); }
+}
+
 async function moveEntryToFolder(id, folder) {
     const e = state.entries.find(x => x.id === id);
     if (!e || e.folder === folder) return;
     try {
+        // PUT requires the full payload — missing fields default server-side
+        // (kind='login' wipes notes through the "Site required" check;
+        // totp_*/custom_fields_* default to empty → cleared via .Clear).
+        // Re-ship every blob bit-for-bit; only `folder` actually changes.
         await api('/entries/' + id, {
             method: 'PUT',
             headers: authHeaders({ 'Content-Type': 'application/json' }),
             body: JSON.stringify({
-                site: e.site, title: e.title || '', username: e.username,
-                encrypted_password: e.encrypted_password, iv: e.iv,
-                folder, tags: e.tags || '',
+                site:               e.site,
+                title:              e.title || '',
+                username:           e.username,
+                encrypted_password: e.encrypted_password,
+                iv:                 e.iv,
+                folder,
+                tags:               e.tags || '',
+                kind:               e.kind || 'login',
+                totp_secret:        e.totp_secret      || '',
+                totp_iv:            e.totp_iv          || '',
+                custom_fields:      e.custom_fields    || '',
+                custom_fields_iv:   e.custom_fields_iv || '',
             }),
         });
         e.folder = folder;
@@ -5567,10 +6121,20 @@ function confirmDialog(opts) {
 }
 
 function promptDialog(opts) {
-    // opts: { title, message, okText, placeholder, value, password }
+    // opts: { title, message, okText, placeholder, value, password, error }
     opts = opts || {};
     $('#confirmTitle').textContent = opts.title   || 'Enter value';
-    $('#confirmMessage').innerHTML = opts.message || '';
+    // Append a transient red error line under the message so the modal
+    // can recycle for retries (wrong password, too-short, etc.) without
+    // a toast that swallows the context.
+    const msgHtml = opts.message || '';
+    const errHtml = opts.error
+        ? '<p style="margin:8px 0 0;color:var(--danger);font-size:12px">' +
+          String(opts.error).replace(/[&<>"]/g,
+              c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c])) +
+          '</p>'
+        : '';
+    $('#confirmMessage').innerHTML = msgHtml + errHtml;
     $('#confirmOkBtn').lastChild.nodeValue = ' ' + (opts.okText || 'OK');
     $('#confirmCancelBtn').textContent = 'Cancel';
     $('#confirmOkBtn').classList.remove('is-danger');
@@ -5599,11 +6163,22 @@ function closeConfirm(value) {
 
 let reauthResolve = null;
 
-function askReauth(message) {
+function askReauth(message, opts) {
+    opts = opts || {};
     return new Promise(resolve => {
         reauthResolve = resolve;
         $('#reauthMessage').textContent = message || 'This action requires your master password.';
         $('#reauthPassword').value = '';
+        const errEl = $('#reauthError');
+        if (errEl) {
+            if (opts.error) {
+                errEl.textContent = opts.error;
+                errEl.classList.remove('is-hidden');
+            } else {
+                errEl.textContent = '';
+                errEl.classList.add('is-hidden');
+            }
+        }
         $('#reauthModal').classList.remove('is-hidden');
         setTimeout(() => $('#reauthPassword').focus(), 50);
     });
@@ -6287,6 +6862,9 @@ async function doChangeMasterPassword() {
         // Step 2: re-encrypt every entry's password AND every entry's TOTP
         // secret (if present) under the new key. The current state.cryptoKey
         // still decrypts the existing ciphertext.
+        // Hoisted so the attachment re-encryption loop after the server
+        // round-trip can still reach the OLD key.
+        const oldKey = state.cryptoKey;
         const encrypted = [];
         for (const e of state.entries) {
             const plain = await decryptPwd(e.encrypted_password, e.iv);
@@ -6294,7 +6872,6 @@ async function doChangeMasterPassword() {
                 throw new Error('Could not decrypt entry id=' + e.id);
             }
             // Swap the key around encryptPwd so it picks up the new one.
-            const oldKey = state.cryptoKey;
             state.cryptoKey = newKey;
             try {
                 const re = await encryptPwd(plain);
@@ -6359,6 +6936,61 @@ async function doChangeMasterPassword() {
         await persistCryptoKey();
         sessionStorage.setItem('salt',          state.salt);
         sessionStorage.setItem('kdfIterations', String(state.kdfIterations));
+        // Server invalidated every session for this user (including ours)
+        // and minted a fresh pair — adopt them so subsequent API calls
+        // don't bounce with "invalid session".
+        if (r.token) {
+            state.token = r.token;
+            sessionStorage.setItem('authToken', r.token);
+        }
+        if (r.csrf) {
+            state.csrf = r.csrf;
+            sessionStorage.setItem('csrfToken', r.csrf);
+        }
+
+        // Re-encrypt attachments under the new vault key. The server-side
+        // change-master endpoint can't touch these (they're opaque to it),
+        // so we fetch each blob, decrypt with the OLD key, encrypt with
+        // the NEW one, and ship it back. Best-effort — a single failure
+        // doesn't undo the rotation, but the user gets a warning toast.
+        try {
+            const allAttach = await api('/attachments/all', { headers: authHeaders() });
+            if (allAttach && allAttach.length > 0) {
+                toast('Re-encrypting ' + allAttach.length + ' attachment(s)…');
+                let failed = 0;
+                for (const meta of allAttach) {
+                    try {
+                        // state.cryptoKey is already newKey at this point.
+                        // Swap to oldKey for decryption, then back for upload.
+                        const full = await api('/attachments/' + meta.id,
+                                               { headers: authHeaders() });
+                        state.cryptoKey = oldKey;
+                        const plainBytes = await decryptBlobBytes(
+                            full.encrypted_blob, full.iv);
+                        state.cryptoKey = newKey;
+                        const re = await encryptBlobBytes(plainBytes);
+                        await api('/attachments/' + meta.id, {
+                            method: 'PUT',
+                            headers: authHeaders({ 'Content-Type': 'application/json' }),
+                            body: JSON.stringify({
+                                encrypted_blob: re.encrypted,
+                                iv:             re.iv,
+                            }),
+                        });
+                    } catch (e) {
+                        failed++;
+                    }
+                }
+                state.cryptoKey = newKey;   // make sure we end on the new key
+                if (failed > 0) {
+                    toast(failed + ' attachment(s) failed to re-encrypt — they may be unreadable. Re-upload from a backup.', 'error');
+                } else {
+                    toast('Attachments re-encrypted');
+                }
+            }
+        } catch (e) {
+            toast('Attachment re-encryption skipped: ' + (e && e.message || e), 'warning');
+        }
         for (let i = 0; i < state.entries.length; i++) {
             const nc = encrypted[i];
             state.entries[i].encrypted_password = nc.encrypted_password;
@@ -6537,16 +7169,25 @@ function parseEntriesFromCSV(text) {
     //   1Password CSV : Title, URL, Username, Password, Notes
     // findColumn normalizes (lowercase, strip _ and -) so 'login_uri' and
     // 'loginuri' both match the same candidate.
-    const colSite   = findColumn(headers, ['name', 'title', 'url', 'site', 'website', 'login_uri', 'login_url', 'web_site']);
+    // Prefer URL-shaped columns for `site` and human-readable name for
+    // `title` so KeePass/Bitwarden exports keep both. Fall back: if only
+    // one is present, reuse it for the other.
+    const colTitle  = findColumn(headers, ['name', 'title', 'item_name', 'entry_name']);
+    const colSite   = findColumn(headers, ['url', 'login_uri', 'login_url', 'site', 'website', 'web_site']);
     const colUser   = findColumn(headers, ['login_username', 'username', 'user', 'login', 'email', 'user_name']);
     const colPwd    = findColumn(headers, ['login_password', 'password', 'pass', 'pwd']);
     const colFolder = findColumn(headers, ['folder', 'group', 'category', 'path', 'collection']);
     const colTags   = findColumn(headers, ['tags', 'labels']);
     const colNotes  = findColumn(headers, ['notes', 'note', 'comment', 'comments']);
     const colTotp   = findColumn(headers, ['login_totp', 'totp', 'totp_secret', 'otp', 'otpauth', 'authenticator', 'two_factor', 'twofa']);
+    // Our own CSV export carries an explicit `kind` column. When absent we
+    // fall back to a heuristic (empty site + non-empty notes = a note).
+    const colKind     = findColumn(headers, ['kind', 'type', 'item_type']);
+    const colTemplate = findColumn(headers, ['template', 'subtype']);
+    const colCustom   = findColumn(headers, ['custom_fields', 'custom']);
 
-    if (colSite === null && colUser === null)
-        throw new Error('No recognizable site/url or username column in CSV header');
+    if (colSite === null && colTitle === null && colUser === null)
+        throw new Error('No recognizable title/url or username column in CSV header');
     if (colPwd === null)
         throw new Error('No recognizable password column in CSV header');
 
@@ -6554,9 +7195,65 @@ function parseEntriesFromCSV(text) {
     let skipped = 0;
     for (let i = 1; i < rows.length; i++) {
         const r = rows[i];
-        const site = (colSite !== null ? r[colSite] : '').trim() ||
-                     (colUser !== null ? r[colUser] : '').trim();
-        const pwd  = (colPwd  !== null ? r[colPwd]  : '');
+        const titleRaw = (colTitle !== null ? r[colTitle] : '').trim();
+        const siteRaw  = (colSite  !== null ? r[colSite]  : '').trim();
+        const pwd      = (colPwd   !== null ? r[colPwd]   : '');
+        const notesRaw = (colNotes !== null ? r[colNotes] : '').trim();
+        // Resolve kind: explicit column wins. Heuristic fallback for foreign
+        // CSVs (Bitwarden/KeePass) — when site+user+pwd are all empty but
+        // notes/title is set, that's a secure-note row.
+        let kindRaw = (colKind !== null ? String(r[colKind] || '').toLowerCase().trim() : '');
+        let kind = (kindRaw === 'note' || kindRaw === 'secure_note') ? 'note' : 'login';
+        if (kindRaw === '' && !siteRaw && !pwd && notesRaw) kind = 'note';
+        const templateRaw = (colTemplate !== null ? String(r[colTemplate] || '').trim() : '');
+
+        // Notes legitimately have no site; their body is in `notes` (or in
+        // `password` when round-tripping our own CSV — we wrote the body
+        // into the password column for the export).
+        // Custom fields cell carries a JSON-stringified array (our own
+        // export shape). Parse defensively — a malformed cell drops to
+        // [] rather than failing the row.
+        let cf = [];
+        if (colCustom !== null) {
+            const raw = String(r[colCustom] || '').trim();
+            if (raw) {
+                try {
+                    const arr = JSON.parse(raw);
+                    if (Array.isArray(arr))
+                        cf = arr.filter(f => f && typeof f === 'object' && f.label);
+                } catch {}
+            }
+        }
+
+        if (kind === 'note') {
+            const body = pwd || notesRaw;
+            if (!body) { skipped++; continue; }
+            const tagsArr = [];
+            if (colTags !== null) {
+                String(r[colTags] || '').split(/[,;]/).forEach(t => {
+                    t = t.trim(); if (t) tagsArr.push(t);
+                });
+            }
+            entries.push({
+                site:          '',
+                title:         titleRaw,
+                username:      '',
+                password:      body,
+                folder:        (colFolder !== null ? r[colFolder] : '').trim() || 'All',
+                tags:          tagsArr.join(','),
+                totp_secret:   '',
+                kind:          'note',
+                template:      templateRaw,
+                custom_fields: cf,
+            });
+            continue;
+        }
+        // Fall through chain: site → title → username so we always have
+        // something to display. The unused string becomes the title for
+        // browser-style cards.
+        const site  = siteRaw  || titleRaw ||
+                      (colUser !== null ? r[colUser] : '').trim();
+        const title = titleRaw || '';
         if (!site || !pwd) { skipped++; continue; }
 
         // Tags: combine the tags column and any free-form notes into a
@@ -6582,17 +7279,22 @@ function parseEntriesFromCSV(text) {
         }
 
         entries.push({
-            site:         site,
-            username:     (colUser   !== null ? r[colUser]   : '').trim(),
-            password:     pwd,
-            folder:       (colFolder !== null ? r[colFolder] : '').trim() || 'All',
-            tags:         tagsArr.join(','),
-            totp_secret:  totp,
+            site:          site,
+            title:         title,
+            username:      (colUser   !== null ? r[colUser]   : '').trim(),
+            password:      pwd,
+            folder:        (colFolder !== null ? r[colFolder] : '').trim() || 'All',
+            tags:          tagsArr.join(','),
+            totp_secret:   totp,
+            kind:          'login',
+            template:      templateRaw,
+            custom_fields: cf,
         });
     }
     return { entries, skipped, columns: {
-        site: colSite, username: colUser, password: colPwd,
+        title: colTitle, site: colSite, username: colUser, password: colPwd,
         folder: colFolder, tags: colTags, notes: colNotes, totp: colTotp,
+        kind: colKind, custom_fields: colCustom,
     } };
 }
 
@@ -6610,20 +7312,44 @@ function parseEntriesFromJSON(text) {
     let skipped = 0;
     for (const e of raw) {
         if (!e || typeof e !== 'object') { skipped++; continue; }
+        const kind = (e.kind === 'note') ? 'note' : 'login';
         const site = String(e.site || e.url || e.name || '').trim();
         const pwd  = String(e.password || '');
-        if (!site || !pwd) { skipped++; continue; }
+        // Notes legitimately have no `site` — their "content" lives in
+        // password (the note body). Logins still need both site + pwd.
+        if (kind === 'login' && (!site || !pwd)) { skipped++; continue; }
+        if (kind === 'note'  && !pwd)            { skipped++; continue; }
 
         const tagsVal = e.tags;
         const tagsStr = Array.isArray(tagsVal) ? tagsVal.join(',')
                         : String(tagsVal || '');
+        // Custom fields: array of {label, value, is_secret}. Tolerate
+        // missing / malformed gracefully — drop the field rather than
+        // failing the entry.
+        let cf = [];
+        if (Array.isArray(e.custom_fields)) {
+            cf = e.custom_fields.filter(f => f && typeof f === 'object' && f.label);
+        }
+        // Attachments: pass through as-is; the import side re-encrypts
+        // the base64 content with the current vault key and POSTs each.
+        let atts = [];
+        if (Array.isArray(e.attachments)) {
+            atts = e.attachments.filter(a =>
+                a && typeof a === 'object' && a.filename && a.content_b64);
+        }
         entries.push({
-            site:        site,
-            username:    String(e.username || e.user || e.login || '').trim(),
-            password:    pwd,
-            folder:      String(e.folder || e.group || 'All').trim() || 'All',
-            tags:        tagsStr,
-            totp_secret: String(e.totp || e.totp_secret || e.otpauth || '').trim(),
+            site:          site,
+            title:         String(e.title || '').trim(),
+            username:      String(e.username || e.user || e.login || '').trim(),
+            password:      pwd,
+            folder:        String(e.folder || e.group || 'All').trim() || 'All',
+            tags:          tagsStr,
+            totp_secret:   String(e.totp || e.totp_secret || e.otpauth || '').trim(),
+            kind:          kind,
+            template:      String(e.template || '').trim(),
+            custom_fields: cf,
+            attachments:   atts,
+            icon_b64:      String(e.icon_b64 || '').trim(),
         });
     }
     return { entries, skipped, columns: null };  // JSON: no column report
@@ -6646,6 +7372,16 @@ async function encryptImportEntry(plain) {
             // 2FA silently. The user can fix it later via the slide-over.
         }
     }
+    // Custom fields: encrypt the same way the slideover does so the row
+    // round-trips through the regular GET path.
+    let cfEnc = '', cfIv = '';
+    if (Array.isArray(plain.custom_fields) && plain.custom_fields.length > 0) {
+        try {
+            const c = await encryptCustomFields(plain.custom_fields);
+            cfEnc = c.encrypted;
+            cfIv  = c.iv;
+        } catch (e) { /* drop silently */ }
+    }
     return {
         site:               plain.site,
         title:              plain.title || '',
@@ -6656,6 +7392,11 @@ async function encryptImportEntry(plain) {
         tags:               plain.tags   || '',
         totp_secret:        totpEnc,
         totp_iv:            totpIv,
+        kind:               plain.kind === 'note' ? 'note' : 'login',
+        custom_fields:      cfEnc,
+        custom_fields_iv:   cfIv,
+        icon_b64:           plain.icon_b64 || '',
+        template:           plain.template || '',
     };
 }
 
@@ -6742,8 +7483,10 @@ async function doImport() {
         });
         if (!confirmed) return;
 
-        // Encrypt all entries client-side, then POST as one transaction.
+        const parsedAtt = parsed.entries.reduce(
+            (n, e) => n + (Array.isArray(e.attachments) ? e.attachments.length : 0), 0);
         toast('Encrypting ' + parsed.entries.length + ' entries…');
+
         const encrypted = [];
         for (const e of parsed.entries) {
             encrypted.push(await encryptImportEntry(e));
@@ -6756,6 +7499,44 @@ async function doImport() {
                 body: JSON.stringify({ entries: encrypted }),
             });
             toast('Imported ' + r.imported + ' entries');
+
+            // Restore attachments. ids[] is parallel-indexed with the
+            // input (-1 = server skipped this row), so we can map back
+            // from each parsed entry to its newly-created server id.
+            const ids = Array.isArray(r.ids) ? r.ids : [];
+            if (parsedAtt > 0 && ids.length === 0) {
+                toast(parsedAtt + ' attachment(s) skipped — server missing /ids response', 'warning');
+            }
+            let attachCount = 0;
+            for (let i = 0; i < parsed.entries.length; i++) {
+                const newId = ids[i];
+                const atts  = parsed.entries[i].attachments;
+                if (typeof newId !== 'number' || newId <= 0) continue;
+                if (!Array.isArray(atts) || atts.length === 0) continue;
+                for (const a of atts) {
+                    try {
+                        const bytes = base64ToBytes(a.content_b64 || '');
+                        // Re-encrypt under the CURRENT vault key — the
+                        // export stored plaintext bytes so a cross-
+                        // account / post-rotation restore still works.
+                        const { encrypted: blob, iv } = await encryptBlobBytes(bytes);
+                        await api('/entries/' + newId + '/attachments', {
+                            method: 'POST',
+                            headers: authHeaders({ 'Content-Type': 'application/json' }),
+                            body: JSON.stringify({
+                                filename:       a.filename,
+                                mime:           a.mime || 'application/octet-stream',
+                                encrypted_blob: blob,
+                                iv,
+                                size_bytes:     a.size_bytes || bytes.length,
+                            }),
+                        });
+                        attachCount++;
+                    } catch (e) { /* skip the single attachment */ }
+                }
+            }
+            if (attachCount > 0) toast(attachCount + ' attachment(s) restored');
+
             await loadEntries();
             render();
             if (state.hibpEnabled) hibpCheckAllEntries();   // scan the new entries too
@@ -6771,43 +7552,69 @@ async function doExport() {
     // Step 1: reauth — verifies the human in front of the screen is the
     // vault owner before we hand them every plaintext password. Defense
     // against a stranger reaching the open laptop and exfiltrating data.
-    const masterPwd = await askReauth(
-        'Enter your master password to start an encrypted export.');
-    if (!masterPwd) return;
-    try {
-        const verifier = await computeVerifier(
-            masterPwd, state.salt, state.kdfIterations || 100000);
-        await api('/reauth', {
-            method: 'POST',
-            headers: authHeaders({ 'Content-Type': 'application/json' }),
-            body: JSON.stringify({ verifier: verifier }),
-        });
-    } catch (err) {
-        // 429 (account lockout) is possible here too — propagate as a clear
-        // message rather than the generic "wrong master password" toast.
-        if (err.status === 429 && err.body && err.body.retry_after) {
-            return toast('Account locked. Try again in ' +
-                Math.ceil(err.body.retry_after / 60) + ' min', 'warning');
+    // Up to 5 retries with inline error in the modal — beyond that the
+    // server-side rate limiter takes over (429 with retry_after).
+    let lastError = null;
+    let attempts = 0;
+    const MAX_ATTEMPTS = 5;
+    let reauthed = false;
+    while (!reauthed) {
+        const masterPwd = await askReauth(
+            'Enter your master password to start an encrypted export.',
+            { error: lastError });
+        if (!masterPwd) return;   // user cancelled
+        try {
+            const verifier = await computeVerifier(
+                masterPwd, state.salt, state.kdfIterations || 100000);
+            await api('/reauth', {
+                method: 'POST',
+                headers: authHeaders({ 'Content-Type': 'application/json' }),
+                body: JSON.stringify({ verifier: verifier }),
+            });
+            reauthed = true;
+        } catch (err) {
+            if (err.status === 429 && err.body && err.body.retry_after) {
+                return toast('Account locked. Try again in ' +
+                    Math.ceil(err.body.retry_after / 60) + ' min', 'warning');
+            }
+            attempts++;
+            if (attempts >= MAX_ATTEMPTS) {
+                return toast('Too many wrong attempts — try again later', 'error');
+            }
+            lastError = 'Wrong master password. Attempt ' +
+                attempts + ' / ' + MAX_ATTEMPTS + '.';
         }
-        return toast('Wrong master password', 'error');
     }
 
     // Step 2: ask for an INDEPENDENT export password. Decoupled from the
     // master pw so a master-pw change later doesn't invalidate the backup,
     // and so the backup can be shared without revealing the master pw.
-    const exportPwd = await promptDialog({
-        title:       'Encrypted export',
-        message:     'Choose a password to encrypt the backup file.<br>' +
-                     '<small style="color:var(--text-dim)">' +
-                     'You will need this password to restore the file. ' +
-                     'It is independent of your master password.</small>',
-        placeholder: 'Backup encryption password',
-        okText:      'Export',
-        password:    true,
-    });
-    if (!exportPwd) return;
-    if (exportPwd.length < 6) {
-        return toast('Use at least 6 characters', 'warning');
+    let exportPwd = null;
+    {
+        let pwdErr = '';
+        let pwdAttempts = 0;
+        const PWD_MAX = 5;
+        for (;;) {
+            const v = await promptDialog({
+                title:       'Encrypted export',
+                message:     'Choose a password to encrypt the backup file.<br>' +
+                             '<small style="color:var(--text-dim)">' +
+                             'You will need this password to restore the file. ' +
+                             'It is independent of your master password.</small>',
+                placeholder: 'Backup encryption password',
+                okText:      'Export',
+                password:    true,
+                error:       pwdErr,
+            });
+            if (!v) return;
+            if (v.length >= 6) { exportPwd = v; break; }
+            pwdAttempts++;
+            if (pwdAttempts >= PWD_MAX) {
+                return toast('Too many invalid attempts', 'error');
+            }
+            pwdErr = 'Use at least 6 characters (attempt ' +
+                     pwdAttempts + ' / ' + PWD_MAX + ').';
+        }
     }
 
     toast('Encrypting backup… (PBKDF2 600k iterations)');
@@ -6828,27 +7635,66 @@ async function doExport() {
                 plainTotp = await decryptTotpSecret(e.totp_secret, e.totp_iv);
                 if (plainTotp === '[ERROR]') plainTotp = '';
             }
+            let plainCustom = [];
+            if (e.custom_fields && e.custom_fields_iv) {
+                try {
+                    plainCustom = await decryptCustomFields(
+                        e.custom_fields, e.custom_fields_iv);
+                } catch (_) { plainCustom = []; }
+            }
+            // Attachments are fetched separately (one extra GET per entry
+            // that has them) so this branch stays cheap on vaults without.
+            let attachments = [];
+            try {
+                const metas = await api('/entries/' + e.id + '/attachments',
+                                        { headers: authHeaders() });
+                for (const m of (metas || [])) {
+                    const full = await api('/attachments/' + m.id,
+                                           { headers: authHeaders() });
+                    const bytes = await decryptBlobBytes(
+                        full.encrypted_blob, full.iv);
+                    attachments.push({
+                        filename:    m.filename,
+                        mime:        m.mime,
+                        size_bytes:  m.size_bytes,
+                        content_b64: bytesToBase64(bytes),
+                    });
+                }
+            } catch (_) { /* partial export beats a failed one */ }
+
             payload.entries.push({
-                site:        e.site,
-                title:       e.title || '',
-                username:    e.username,
-                password:    plain,
-                folder:      e.folder,
-                tags:        parseTags(e.tags),
-                favorite:    !!e.favorite,
-                totp_secret: plainTotp,
-                kind:        e.kind || 'login',
-                created_at:  e.created_at,
-                updated_at:  e.updated_at,
+                site:           e.site,
+                title:          e.title || '',
+                username:       e.username,
+                password:       plain,
+                folder:         e.folder,
+                tags:           parseTags(e.tags),
+                favorite:       !!e.favorite,
+                totp_secret:    plainTotp,
+                kind:           e.kind || 'login',
+                template:       e.template || '',
+                custom_fields:  plainCustom,
+                attachments:    attachments,
+                icon_b64:       e.icon_b64 || '',
+                created_at:     e.created_at,
+                updated_at:     e.updated_at,
             });
         }
 
+        const attachTotal = payload.entries.reduce(
+            (n, e) => n + (Array.isArray(e.attachments) ? e.attachments.length : 0), 0);
+
         // Step 4: encrypt + save via native dialog
         const container = await encryptExportPayload(payload, exportPwd);
         const json = JSON.stringify(container, null, 2);
         const fname = 'vault-export-' + new Date().toISOString().slice(0, 10) + '.json';
         const res = await Bridge.saveFile(fname, json);
-        if (res.ok) toast(payload.entries.length + ' entries exported to ' + res.path);
+        if (res.ok) {
+            const tail = attachTotal > 0
+                ? ' + ' + attachTotal + ' attachment(s)' : '';
+            toast(payload.entries.length + ' entries' + tail +
+                  ' exported to ' + res.path);
+        }
         else if (res.error) toast('Export failed: ' + res.error, 'error');
     } catch (err) {
         toast('Export failed: ' + (err && err.message ? err.message : err), 'error');
@@ -6871,8 +7717,11 @@ async function doExportCSV() {
             'The CSV file is <b>NOT encrypted</b>. Passwords, note bodies and ' +
             'custom field values will be written in plaintext, readable by ' +
             'anyone who opens the file.<br><br>' +
-            'Use only for migration to another password manager — delete ' +
-            'the file as soon as the import is done.',
+            '<b>Not included in CSV</b>: encrypted attachments and custom ' +
+            'favicons. Use <i>Encrypted JSON</i> export for a complete ' +
+            'backup that round-trips everything.<br><br>' +
+            'Use this format only for migration to another password ' +
+            'manager — delete the file as soon as the import is done.',
         okText: 'Export plaintext',
         danger: true,
     });
@@ -6880,7 +7729,7 @@ async function doExportCSV() {
 
     // Decrypt everything client-side (server never sees plaintext).
     const rows = [[
-        'kind', 'title', 'site', 'username', 'password',
+        'kind', 'template', 'title', 'site', 'username', 'password',
         'totp_secret', 'folder', 'tags',
         'custom_fields', 'created_at', 'updated_at',
     ]];
@@ -6898,6 +7747,7 @@ async function doExportCSV() {
         }
         rows.push([
             e.kind || 'login',
+            e.template || '',
             e.title || '',
             e.site || '',
             e.username || '',
@@ -7244,6 +8094,18 @@ function openSettings() {
     $('#settingTrashPurge').value = String(state.trashAutoPurgeDays || 0);
     $('#settingPasswordExpiry').value = String(state.passwordExpiryDays || 0);
     $('#settingUser').textContent = state.username;
+    // Hide the version row entirely in the PHP/web frontend (no bridge).
+    if (Bridge.active) {
+        $('#settingVersionRow').style.display = '';
+        Promise.all([Bridge.getAppVersion(), Bridge.getLaunchMode()]).then(([v, mode]) => {
+            const tag = mode === 'auto'   ? ' · started with Windows'
+                      : mode === 'manual' ? ' · launched manually'
+                      : '';
+            $('#settingVersion').textContent = (v ? 'v' + v : '(unknown)') + tag;
+        });
+    } else {
+        $('#settingVersionRow').style.display = 'none';
+    }
     // Async: query server for recovery key state and update the label
     refreshRecoveryStatus();
 
@@ -7474,19 +8336,31 @@ async function pickAutoBackupFolder() {
 }
 
 async function promptAndStoreBackupPwd() {
-    const pwd = await promptDialog({
-        title: 'Choose a backup password',
-        message: 'You will need this to restore the auto-backups. Save it somewhere safe — it is independent of your master password.',
-        placeholder: 'At least 6 characters',
-        password: true,
-        okText: 'Save',
-    });
-    if (!pwd || pwd.length < 6) {
-        toast('Auto-backup cancelled — password too short', 'warning');
-        return false;
+    let lastError = '';
+    let attempts = 0;
+    const MAX_ATTEMPTS = 5;
+    for (;;) {
+        const pwd = await promptDialog({
+            title: 'Choose a backup password',
+            message: 'You will need this to restore the auto-backups. Save it somewhere safe — it is independent of your master password.',
+            placeholder: 'At least 6 characters',
+            password: true,
+            okText: 'Save',
+            error: lastError,
+        });
+        if (pwd === null || pwd === undefined) return false;   // cancelled
+        if (pwd.length >= 6) {
+            Bridge.setPref(ABK.pwd, pwd);
+            return true;
+        }
+        attempts++;
+        if (attempts >= MAX_ATTEMPTS) {
+            toast('Too many invalid attempts', 'error');
+            return false;
+        }
+        lastError = 'Password must be at least 6 characters (attempt ' +
+                    attempts + ' / ' + MAX_ATTEMPTS + ').';
     }
-    Bridge.setPref(ABK.pwd, pwd);
-    return true;
 }
 
 async function onToggleAutoBackup(ev) {
@@ -7535,11 +8409,38 @@ async function runAutoBackupNow() {
                 plainTotp = await decryptTotpSecret(e.totp_secret, e.totp_iv);
                 if (plainTotp === '[ERROR]') plainTotp = '';
             }
+            let plainCustom = [];
+            if (e.custom_fields && e.custom_fields_iv) {
+                try { plainCustom = await decryptCustomFields(
+                    e.custom_fields, e.custom_fields_iv); }
+                catch (_) { plainCustom = []; }
+            }
+            let attachments = [];
+            try {
+                const metas = await api('/entries/' + e.id + '/attachments',
+                                        { headers: authHeaders() });
+                for (const m of (metas || [])) {
+                    const full = await api('/attachments/' + m.id,
+                                           { headers: authHeaders() });
+                    const bytes = await decryptBlobBytes(
+                        full.encrypted_blob, full.iv);
+                    attachments.push({
+                        filename:    m.filename,
+                        mime:        m.mime,
+                        size_bytes:  m.size_bytes,
+                        content_b64: bytesToBase64(bytes),
+                    });
+                }
+            } catch (_) {}
             payload.entries.push({
                 site: e.site, title: e.title || '', username: e.username,
                 password: plain, folder: e.folder, tags: parseTags(e.tags),
                 favorite: !!e.favorite, totp_secret: plainTotp,
                 kind: e.kind || 'login',
+                template: e.template || '',
+                custom_fields: plainCustom,
+                attachments: attachments,
+                icon_b64: e.icon_b64 || '',
                 created_at: e.created_at, updated_at: e.updated_at,
             });
         }
@@ -7805,6 +8706,7 @@ async function init() {
         if (mod && e.shiftKey && /^[nNwW]$/.test(e.key))   return e.preventDefault();   // New incognito / Close window
         if (mod && e.shiftKey && e.key === 'Delete')        return e.preventDefault();   // Clear browsing data
     });
+    document.addEventListener('keydown', handleCardCursorKey);
 
     // Auth tabs
     $$('.auth-tab').forEach(t => {
@@ -7860,6 +8762,14 @@ async function init() {
             openSlideOver(null, { kind });
         });
     });
+    $$('#newEntryMenu [data-new-template]').forEach(b => {
+        b.addEventListener('click', ev => {
+            ev.stopPropagation();
+            const template = b.getAttribute('data-new-template');
+            $('#newEntryMenu').classList.add('is-hidden');
+            openSlideOver(null, { template });
+        });
+    });
     // Close the dropdown on any other click.
     document.addEventListener('click', e => {
         if (!e.target.closest('.new-entry-wrap'))
@@ -7907,10 +8817,49 @@ async function init() {
     }
 
     // Search
+    let searchHistoryDebounce = null;
     $('#searchInput').addEventListener('input', e => {
         state.search = e.target.value;
         state.currentPage = 1;
         renderGrid();
+        // Hide history while user is actively typing; it pops back on
+        // focus when the field is empty.
+        if (e.target.value) $('#searchHistoryMenu').classList.add('is-hidden');
+        else                renderSearchHistoryMenu();
+        // Commit to history after a pause — captures the live-typing case
+        // where the user finds what they wanted without ever pressing
+        // Enter or blurring the field.
+        if (searchHistoryDebounce) clearTimeout(searchHistoryDebounce);
+        const v = e.target.value.trim();
+        if (v.length >= 2) {
+            searchHistoryDebounce = setTimeout(() => pushSearchHistory(v), 1000);
+        }
+    });
+    $('#searchInput').addEventListener('focus', () => {
+        if (!$('#searchInput').value) renderSearchHistoryMenu();
+    });
+    $('#searchInput').addEventListener('keydown', e => {
+        // Enter commits the current term to history. Blur with a non-empty
+        // value also commits — handled below.
+        if (e.key === 'Enter' && $('#searchInput').value.trim()) {
+            pushSearchHistory($('#searchInput').value.trim());
+            $('#searchHistoryMenu').classList.add('is-hidden');
+        } else if (e.key === 'Escape') {
+            $('#searchHistoryMenu').classList.add('is-hidden');
+        }
+    });
+    $('#searchInput').addEventListener('blur', () => {
+        const v = $('#searchInput').value.trim();
+        if (v) pushSearchHistory(v);
+        // Delay-hide so a click on a history item can still register.
+        setTimeout(() => $('#searchHistoryMenu').classList.add('is-hidden'), 120);
+    });
+    // Click-outside also dismisses (covers the case where focus moves via
+    // keyboard to a non-blurring element).
+    document.addEventListener('click', e => {
+        if (!e.target.closest('.search')) {
+            $('#searchHistoryMenu').classList.add('is-hidden');
+        }
     });
 
     // Slide-over
@@ -7918,10 +8867,31 @@ async function init() {
     // Click outside the slide-over closes it. Clicks on cards re-open it for
     // another entry (so we don't close in that case; the card's own handler
     // will switch state.selectedId).
+    // mousedown origin is captured so a drag-selection that starts inside
+    // an input and ends outside doesn't trigger close (the resulting click
+    // event has a target outside the slideover even though the user never
+    // intended to dismiss it).
+    // Esc closes the slideover.
+    document.addEventListener('keydown', e => {
+        if (e.key !== 'Escape') return;
+        if (!$('#slideover').classList.contains('is-open')) return;
+        if (document.querySelector('.modal:not(.is-hidden)')) return;
+        closeSlideOver();
+    });
+    // Click-outside closes too. mousedown origin is captured so a
+    // drag-selection that starts inside an input and ends outside doesn't
+    // count as an outside click. Cards/rows/modals/etc. are whitelisted
+    // so clicks on them don't dismiss the panel.
+    let _slideoverMouseDownInside = false;
+    document.addEventListener('mousedown', e => {
+        _slideoverMouseDownInside = !!(e.target.closest && e.target.closest('.slideover'));
+    }, true);
     document.addEventListener('click', e => {
         if (!$('#slideover').classList.contains('is-open')) return;
+        if (_slideoverMouseDownInside) { _slideoverMouseDownInside = false; return; }
         if (e.target.closest('.slideover')) return;
         if (e.target.closest('.entry-card')) return;
+        if (e.target.closest('.entry-row'))  return;
         if (e.target.closest('.modal')) return;
         if (e.target.closest('.cmd-palette')) return;
         if (e.target.closest('.idle-warning')) return;