fix(desktop): stop pushing a snapshot that changed nothing

Measured on the phone, opening a cached vault: 121 ms to read the sealed file,
14 ms to display it - and then 5718 ms decrypting a snapshot it already had.

The cause is upstream. A sync pushes unconditionally at the end, and the push
is never a no-op: the container is re-encrypted with a fresh salt and IV, so an
identical vault produces completely different bytes. On Gitea that is one more
commit and a new blob sha, so every other device sees a "new" snapshot and pays
a full key derivation to arrive back where it started. It also grew the
repository on every sync that changed nothing, which is the history cost the
plan warns about.

The merged state is now compared against what was pulled, as plaintext -
the only place equality is observable - ignoring snapshot_at, which changes by
construction. Equal means the push is skipped and the sync still counts as done,
timestamp included: having nothing to write is a success, not an absence.

The comparison is deliberately strict. A false negative costs one commit; a
false positive would silence a push that carried a change and lose it for the
other devices. Four tests fix where that line sits, including a modified
updated_at (which arbitrates the merge elsewhere) and a tombstone (a deletion
that has to propagate).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mainApk.pas

@@ -574,10 +574,23 @@ end;
 procedure TForm8.OpenLocalNow;
 var
   LPlain, LETag, LPwd: string;
+  LSw: TStopwatch;
 begin
+  // CHRONOMETRE EN TROIS TEMPS. Une ouverture depuis le cache doit etre
+  // instantanee : c'est toute la raison d'etre de PMA.Store. Quand elle ne
+  // l'est pas, il faut savoir LEQUEL des trois coute - la lecture du fichier
+  // scelle, la mise en forme vers la page, ou le rafraichissement de fond qui
+  // suit - sinon on cherche au hasard.
+  LSw := TStopwatch.StartNew;
   if LoadVault(LPlain, LETag, LPwd) then
   begin
+    Log('Vault opened from cache in ' + LSw.ElapsedMilliseconds.ToString + ' ms');
     FETag := LETag;
+    if LETag = '' then
+      // Sans empreinte, le rafraichissement qui suit ne peut pas savoir que
+      // rien n'a change : il retelechargera et redechiffrera a chaque
+      // ouverture. C'est exactement le cout que le cache doit supprimer.
+      Log('  WARNING: cache has no fingerprint - the refresh will re-derive');
     if LPwd <> '' then FSyncPwd := LPwd;
 
     // LA PROTECTION RATTRAPE LE CACHE. Elle se decidait a l'ecriture seule,
@@ -610,7 +623,9 @@ begin
     end;
 
     try
+      LSw := TStopwatch.StartNew;
       AdoptVault(LPlain);
+      Log('  displayed in ' + LSw.ElapsedMilliseconds.ToString + ' ms');
       // Afficher d'abord, synchroniser ensuite : le coffre est a l'ecran, le
       // reseau se debrouille derriere. Sans mot de passe range, on ne peut
       // rien ouvrir de nouveau - inutile d'aller voir.