feat: entry templates + tag autocomplete + slideover push + robustness bundle

- Entry templates: new vault_entries.template column drives a typed
  sub-kind ('credit-card', 'ssh-key', 'server', 'recovery-codes'). Card
  + table label off the template, badge reads "credit card" instead of
  "note". Templates seed kind=note (no site/password required), use
  custom_fields with optional dropdown options (brand, month/year,
  protocol). Round-tripped across export/import/duplicate/master-pw
  rotation, preserved by partial PUTs via a HasTemplate flag.
- Custom fields: support per-field `options[]` rendering as <select>
  (card brand, expiry MM/YYYY, SSH/server protocol).
- Tags: existing-tag autocomplete dropdown under the chip input,
  filtered against what's already selected.
- Search history: per-query X for individual delete + 1s debounced
  commit (no Enter required).
- Slideover: clicking outside closes again (drag-selection respected
  via mousedown origin tracker), Esc closes, X closes. App shell is
  pushed left by 420px when the panel is open so the table / pagination
  / sort / search stay visible and interactive.
- Export/import: JSON now round-trips custom_fields, attachments
  (decrypted to base64, re-encrypted under current key on restore),
  icon_b64, and template. CSV warning lists what's not included.
- Auto-backup: same payload shape as user-driven export.
- Notes: import (JSON + CSV) accepts kind=note with empty site,
  preserves title/template/custom_fields. CSV parser detects kind/
  template columns.
- Bulk-import response returns `ids[]` parallel to input so the
  client can map back to new entry IDs (drives attachment restore).
- Move-to-folder bugs fixed: moveEntryToFolder, batchMoveToFolder,
  addTag, batchAddTag were all silently wiping TOTP / custom_fields
  / kind / template via partial PUT. Now re-ship full payload.
- Master-pw rotation: server mints a fresh session token + csrf so
  the very next request after rotation no longer ESessionRejects.
  Client adopts the new pair. Attachments are re-encrypted client-side
  during rotation (GET old → decrypt with old key → encrypt with new
  → PUT). New endpoints: GET /attachments/all, PUT /attachments/:id.
- Duplicate: carries icon_b64 + template + attachments to the copy.
- HandleCreateEntry: accepts icon_b64.
- FireDAC param fix: all blob/icon/custom_fields params use ftMemo +
  .Value assignment so SQLite TEXT no longer truncates to 4000 chars
  (deepseek's 200+ KB favicon was being wiped on lock/unlock).
- HandleSetEntryIcon cap: 262144 → 524288 chars (base64 of a 256 KB
  raw fetch overflows the old cap, fails silently in saveEntryIcon).
- Native save dialog: surfaces server errors instead of swallowing.
- Modals: reauth (export) + backup-password prompt support inline
  error display, retry up to 5 attempts, then hard-stop.
- Keyboard cursor (j/k): bootstraps to current page, auto-paginates
  when the cursor crosses a page boundary, Enter opens slideover.
- Slideover focuses Title on edit-open so j/k → Enter → type Just
  Works.
- TOTP tool: Esc closes the modal.
- App version + launch mode (auto/manual): exposed via bridge,
  surfaced in Settings → Account. Autostart launches suppress the
  first-time tray balloon.
- Passkey button hidden (Delphi backend stubs WebAuthn at 501).
- TEST_PLAN.md captured for regression coverage.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/UMainForm.pas

@@ -13,6 +13,8 @@
 
 interface
 
+
+
 uses
   System.SysUtils, System.Classes, System.UITypes, System.NetEncoding,
   System.StrUtils, System.Generics.Collections, System.IOUtils, System.JSON,
@@ -33,7 +35,10 @@ uses
   PM.HTTPServer, PM.Bridge, PM.QuickUnlock, PM.UserPrefs, PM.AutoStart,
   PM.Favicon,
   FMX.Platform.Win, FMX.Menus;  // WindowHandleToPlatform → HWND for visibility check
-
+const
+  // Bump on each release. Surfaced to JS via cmd://app/version, displayed
+  // in Settings → Account so users can report bugs with the right build.
+  APP_VERSION = '1.0.0';
 type
   // Concrete class chosen at compile time. Both inherit from
   // TTMSFNCCustomWebBrowser so we use that as the field type — events
@@ -212,11 +217,15 @@ begin
   // initial Show before we hide it — minimises the visible flash.
   if FindCmdLineSwitch('tray', True) then
   begin
+    // Suppress the first-time tray balloon for autostart launches —
+    // it's noise when Windows itself put us in the tray (the user
+    // didn't actively minimise). Manual launches still see it once.
+    FBridge.BalloonShown := True;
     TThread.ForceQueue(nil,
       procedure
       begin
         FBridge.MinimizeToTray;
-        LogLine('Launched with --tray, minimised at startup');
+        LogLine('Launched with --tray, minimised at startup (balloon suppressed)');
       end);
   end;
 end;
@@ -742,6 +751,24 @@ begin
   else if ACmd = 'app/theme' then
     FBridge.ApplyTitleBarTheme(GetParam('mode') = 'dark')
 
+  // Build/version string exposed to JS for the Settings → About panel.
+  // Hardcoded const — bump manually on releases. Kept simple to avoid
+  // pulling Windows resource version info at runtime.
+  else if ACmd = 'app/version' then
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onVersionResult)' +
+      'Bridge.onVersionResult("' + APP_VERSION + '")')
+
+  // Launch context: the HKCU Run entry passes -tray so we can tell
+  // "Windows started me at boot" from "user double-clicked the exe".
+  // Useful for Settings → Account display and for conditional behavior
+  // (e.g. skip first-time tooltips on autostart).
+  else if ACmd = 'app/launch-mode' then
+    WebBrowser.ExecuteJavaScript(
+      'if(window.Bridge&&Bridge.onLaunchModeResult)' +
+      'Bridge.onLaunchModeResult("' +
+      IfThen(FindCmdLineSwitch('tray', True), 'auto', 'manual') + '")')
+
   // Open the entry's site in the user's default browser. We restrict the
   // scheme to http(s) so JS can't smuggle a file:// or other handler that
   // would invoke arbitrary Windows applications.