feat: tray quick-search + privacy hardening + race fixes

Quick search from tray
- New "Quick search…" entry in the tray context menu (between Open
  and Lock vault).
- Compact modal with live-filtered top-8 entries, arrow keys / Enter
  to copy the password (Shift+Enter copies the username instead),
  Esc to dismiss. Each row shows the favicon when cached.
- Locked vault → focus the master password input instead of opening
  the modal (same pattern as the locked-autofill-hotkey path).
- Window-state restore: Delphi remembers whether the window was
  hidden before the menu was opened and tells JS via the
  Bridge.openQuickSearch(wasHidden) arg. After the copy (or cancel)
  we hide back to the tray so the previously-foreground app comes
  back and Ctrl+V drops the password in.

Tray notifications toggle
- New Settings → Security "Show tray notifications" toggle. Gates
  Shell_NotifyIcon NIF_INFO balloons (currently only the "still
  running in the tray" first-time popup). Default ON, synced via
  settings_json so it follows the user across devices.
- PM.Bridge.ShowNotifications exposed as a public property; JS
  pushes the value on every settings sync.

Privacy: WebView2 phone-home killed
- WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS set in the unit
  initialization section (before the TMS WebBrowser instantiates
  its CoreWebView2Environment). Disables: background networking,
  sync, component updates, breakpad/crashpad, domain reliability,
  client-side phishing detection, experiments, UMA upload,
  MediaRouter, OptimizationHints, SafeBrowsing enhanced, autofill
  server, privacy sandbox APIs. Verified via Resource Monitor: only
  127.0.0.1 connections remain (plus DDG when favicons are on).

Fixes
- Blank-window-on-launch race: the 1.5 s navigation timer assumes
  WebView2 finishes init in time, but on slow machines Edge
  Chromium needs 2-3 s and the Navigate() call is silently
  dropped. WebBrowserInitialized now also navigates if a URL is
  still pending — first to run wins.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

index.html

@@ -426,6 +426,20 @@
                         <span class="toggle-slider"></span>
                     </label>
                 </div>
+                <div class="setting-row" id="settingTrayNotifRow">
+                    <span>
+                        Show tray notifications
+                        <small class="setting-hint">
+                            The first time the app minimises to the tray
+                            it shows a small balloon explaining how to
+                            restore it. Turn off if you've seen it.
+                        </small>
+                    </span>
+                    <label class="toggle">
+                        <input type="checkbox" id="settingTrayNotif">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
                 <div class="setting-row" id="settingAutoStartRow">
                     <span>
                         Start with Windows
@@ -709,6 +723,27 @@
     </div>
 </div>
 
+<!-- ============================================================ -->
+<!-- MODAL: Quick search (tray menu → fast password copy)          -->
+<!-- ============================================================ -->
+<div id="quickSearchModal" class="modal is-hidden" role="dialog" aria-modal="true">
+    <div class="modal-backdrop" data-close></div>
+    <div class="modal-panel modal-panel-sm quick-search-panel">
+        <div class="quick-search-input">
+            <svg><use href="#i-search"/></svg>
+            <input id="quickSearchInput" type="text"
+                   placeholder="Search and press Enter to copy password…"
+                   autocomplete="off">
+            <kbd>Esc</kbd>
+        </div>
+        <div class="quick-search-results" id="quickSearchResults"></div>
+        <div class="quick-search-hint">
+            Enter = copy password &middot; Shift+Enter = copy username &middot;
+            click = copy password &middot; Esc = close
+        </div>
+    </div>
+</div>
+
 <!-- ============================================================ -->
 <!-- MODAL: Standalone TOTP generator (paste secret → live code)   -->
 <!-- ============================================================ -->