feat: native save + auto-backup + folder customization + attachments + UX bundle

- File: native Save As dialog via Bridge.saveFile (replaces WebView2
  browser download popup) for encrypted JSON + CSV exports.
- Auto-backup: silent periodic encrypted JSON to a chosen folder,
  user-set interval + retention, separate DPAPI-stored password, runs
  5s after unlock if due. New file/* bridge cmds (folder/pick,
  file/write, file/listMatch, file/delete).
- Folders: per-folder color + icon (8-swatch palette, 8 icon presets),
  drag-reorder via HTML5 DnD with insert-line indicators, edit pencil
  on hover. New POST /folders/reorder + PUT /folders/{name}. Folder
  chip on cards inherits custom icon + color.
- Recently used: vault_entries.accessed_at + POST /entries/{id}/touch
  (debounced 2s), sidebar Tools entry showing top-10 by accessed_at.
- Encrypted attachments: per-entry file storage (5MB cap), AES-GCM
  with vault key, native Save As download, paperclip upload in
  slideover. New entry_attachments table + PM.Handler.Attachments.
- Password expiry: vault_entries.password_changed_at (conditional bump
  via SQL CASE only when ciphertext differs), passwordExpiryDays
  setting, "Aged" badge on cards + matching Filters chip.
- Recovery: Print button on generated code modal (A4 printable sheet
  via @media print, code in 32px monospace + instructions).
- Audit log viewer (sidebar Tools, GET /audit with pagination cursor).
- Plaintext CSV export + Filters dropdown with 9 predicates.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Audit.pas

@@ -1,13 +1,11 @@
 unit PM.Handler.Audit;
 
 (*
-  POST /audit    body {action, site}   -> {ok:true}
+  POST /audit    body {action, site}            -> {ok:true}
+  GET  /audit?limit=N&before=<id>               -> [{id, action, ip, created_at}, ...]
 
-  Light-weight endpoint that lets the JS layer append an entry to audit_log
-  without going through the full entries pipeline. Used by the autofill
-  feature to record which site was filled (action = "autofill:<site>").
-  The bearer token identifies the user — no data beyond the action string
-  is stored.
+  audit_log is auto-purged after 30 days by Database init. The viewer
+  reads page-by-page via the `before` cursor (id < before).
 *)
 
 interface
@@ -17,7 +15,8 @@ implementation
 uses
   System.SysUtils, System.JSON,
   IdCustomHTTPServer,
-  PM.Router, PM.JSON, PM.Session, PM.Audit;
+  Data.DB, FireDAC.Comp.Client, FireDAC.Stan.Param,
+  PM.Router, PM.JSON, PM.Session, PM.Audit, PM.Database;
 
 function GetClientIP(ARequest: TIdHTTPRequestInfo): string;
 begin
@@ -59,7 +58,67 @@ begin
   TJSONHelper.SendOK(AResponse);
 end;
 
+// GET /audit — return up to `limit` log entries for the current user,
+// optionally newer-than-cursor (`before` = id). Most-recent first.
+procedure HandleGetAudit(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LLimit, LBefore: Integer;
+  LQ: TFDQuery;
+  LArr: TJSONArray;
+  LObj: TJSONObject;
+begin
+  LUserId := Authenticate(ARequest, AResponse);
+
+  LLimit  := StrToIntDef(ARequest.Params.Values['limit'], 100);
+  if LLimit <= 0 then LLimit := 100;
+  if LLimit > 500 then LLimit := 500;
+  LBefore := StrToIntDef(ARequest.Params.Values['before'], 0);
+
+  LArr := TJSONArray.Create;
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      if LBefore > 0 then
+        LQ.SQL.Text :=
+          'SELECT id, action, ip, created_at FROM audit_log ' +
+          'WHERE user_id = :uid AND id < :b ' +
+          'ORDER BY id DESC LIMIT :l'
+      else
+        LQ.SQL.Text :=
+          'SELECT id, action, ip, created_at FROM audit_log ' +
+          'WHERE user_id = :uid ' +
+          'ORDER BY id DESC LIMIT :l';
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ParamByName('l').AsInteger   := LLimit;
+      if LBefore > 0 then
+        LQ.ParamByName('b').AsInteger := LBefore;
+      LQ.Open;
+      while not LQ.Eof do
+      begin
+        LObj := TJSONObject.Create;
+        LObj.AddPair('id', TJSONNumber.Create(LQ.FieldByName('id').AsInteger));
+        LObj.AddPair('action', LQ.FieldByName('action').AsString);
+        LObj.AddPair('ip', LQ.FieldByName('ip').AsString);
+        LObj.AddPair('created_at',
+          FormatDateTime('yyyy-mm-dd hh:nn:ss',
+            LQ.FieldByName('created_at').AsDateTime));
+        LArr.Add(LObj);
+        LQ.Next;
+      end;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendJSON(AResponse, LArr);
+end;
+
 initialization
   Router.Register('POST', '/audit', HandlePostAudit);
+  Router.Register('GET',  '/audit', HandleGetAudit);
 
 end.