feat: native save + auto-backup + folder customization + attachments + UX bundle

- File: native Save As dialog via Bridge.saveFile (replaces WebView2
  browser download popup) for encrypted JSON + CSV exports.
- Auto-backup: silent periodic encrypted JSON to a chosen folder,
  user-set interval + retention, separate DPAPI-stored password, runs
  5s after unlock if due. New file/* bridge cmds (folder/pick,
  file/write, file/listMatch, file/delete).
- Folders: per-folder color + icon (8-swatch palette, 8 icon presets),
  drag-reorder via HTML5 DnD with insert-line indicators, edit pencil
  on hover. New POST /folders/reorder + PUT /folders/{name}. Folder
  chip on cards inherits custom icon + color.
- Recently used: vault_entries.accessed_at + POST /entries/{id}/touch
  (debounced 2s), sidebar Tools entry showing top-10 by accessed_at.
- Encrypted attachments: per-entry file storage (5MB cap), AES-GCM
  with vault key, native Save As download, paperclip upload in
  slideover. New entry_attachments table + PM.Handler.Attachments.
- Password expiry: vault_entries.password_changed_at (conditional bump
  via SQL CASE only when ciphertext differs), passwordExpiryDays
  setting, "Aged" badge on cards + matching Filters chip.
- Recovery: Print button on generated code modal (A4 printable sheet
  via @media print, code in 32px monospace + instructions).
- Audit log viewer (sidebar Tools, GET /audit with pagination cursor).
- Plaintext CSV export + Filters dropdown with 9 predicates.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Entries.pas

@@ -139,6 +139,14 @@ begin
           LObj.AddPair('custom_fields_iv', LQ.FieldByName('custom_fields_iv').AsString);
         LObj.AddPair('created_at', ISODateTimeField(LQ.FieldByName('created_at')));
         LObj.AddPair('updated_at', ISODateTimeField(LQ.FieldByName('updated_at')));
+        if LQ.FieldByName('accessed_at').IsNull then
+          LObj.AddPair('accessed_at', TJSONNull.Create)
+        else
+          LObj.AddPair('accessed_at', ISODateTimeField(LQ.FieldByName('accessed_at')));
+        if LQ.FieldByName('password_changed_at').IsNull then
+          LObj.AddPair('password_changed_at', TJSONNull.Create)
+        else
+          LObj.AddPair('password_changed_at', ISODateTimeField(LQ.FieldByName('password_changed_at')));
         LArr.Add(LObj);
         LQ.Next;
       end;
@@ -213,9 +221,9 @@ begin
         'INSERT INTO vault_entries ' +
         '(user_id, site, title, username, encrypted_password, iv, encryption_method, ' +
         ' folder, tags, totp_secret, totp_iv, kind, custom_fields, custom_fields_iv,' +
-        ' created_at, updated_at) ' +
+        ' created_at, updated_at, password_changed_at) ' +
         'VALUES (:uid, :s, :tt, :u, :e, :i, ''client'', :f, :t, :ts, :tiv, :k, ' +
-        ' :cf, :cfiv, :c, :c2)';
+        ' :cf, :cfiv, :c, :c2, :c)';
       LQ.ParamByName('uid').AsInteger := LUserId;
       LQ.ParamByName('s').AsString  := LSite;
       LQ.ParamByName('tt').AsString := LTitle;
@@ -355,12 +363,16 @@ begin
       LQ.ParamByName('id').AsInteger := LId;
       LQ.ExecSQL;
 
+      // password_changed_at fires only when the ciphertext actually
+      // changes — same conditional used above for history insertion.
       LQ.SQL.Text :=
         'UPDATE vault_entries ' +
         'SET site=:s, title=:tt, username=:u, encrypted_password=:e, iv=:i, ' +
         '    folder=:f, tags=:t, totp_secret=:ts, totp_iv=:tiv, kind=:k, ' +
         '    custom_fields=:cf, custom_fields_iv=:cfiv, ' +
-        '    updated_at=:c ' +
+        '    updated_at=:c, ' +
+        '    password_changed_at = CASE WHEN encrypted_password <> :e ' +
+        '                          THEN :c ELSE password_changed_at END ' +
         'WHERE id=:id AND user_id=:uid';
       LQ.ParamByName('s').AsString    := LSite;
       LQ.ParamByName('tt').AsString   := LTitle;
@@ -546,6 +558,51 @@ begin
   TJSONHelper.SendOK(AResponse, 'Toggled');
 end;
 
+// ===== POST /entries/{id}/touch ==============================================
+// Bumps accessed_at. Called from JS on copy / slideover-open so the sidebar
+// "Recent" view can show what the user actually uses. Auth-only (no CSRF
+// requirement — this is a write but harmless to forge across sessions, and
+// the call is fire-and-forget from clipboard handlers where blocking on
+// CSRF would be visibly laggy).
+procedure HandleTouchEntry(ARequest: TIdHTTPRequestInfo;
+  AResponse: TIdHTTPResponseInfo; const AParams: TArray<string>);
+var
+  LUserId, LId: Integer;
+  LQ: TFDQuery;
+begin
+  try
+    LUserId := Authenticate(ARequest, AResponse);
+  except
+    on ESessionRejected do Exit;
+  end;
+
+  LId := StrToIntDef(AParams[0], 0);
+  if LId = 0 then
+  begin
+    TJSONHelper.SendError(AResponse, 400, 'Invalid id');
+    Exit;
+  end;
+
+  DB.Lock;
+  try
+    LQ := TFDQuery.Create(nil);
+    try
+      LQ.Connection := DB.Connection;
+      LQ.SQL.Text :=
+        'UPDATE vault_entries SET accessed_at = CURRENT_TIMESTAMP ' +
+        'WHERE id = :id AND user_id = :uid AND deleted = 0';
+      LQ.ParamByName('id').AsInteger  := LId;
+      LQ.ParamByName('uid').AsInteger := LUserId;
+      LQ.ExecSQL;
+    finally
+      LQ.Free;
+    end;
+  finally
+    DB.Unlock;
+  end;
+  TJSONHelper.SendOK(AResponse);
+end;
+
 // ===== POST /entries/{id}/icon ===============================================
 // Stores (or clears) a cached favicon for one entry. Separate endpoint so the
 // client can save the icon without re-PUT-ing the full entry (which would
@@ -968,6 +1025,7 @@ initialization
   Router.Register('POST',   '/entries/bulk-import',    HandleBulkImport);
   Router.Register('POST',   '/entries/(\d+)/restore',  HandleRestoreEntry);
   Router.Register('POST',   '/entries/(\d+)/favorite', HandleToggleFavorite);
+  Router.Register('POST',   '/entries/(\d+)/touch',    HandleTouchEntry);
   Router.Register('POST',   '/entries/(\d+)/icon',     HandleSetEntryIcon);
   Router.Register('GET',    '/entries/(\d+)/history',  HandleGetEntryHistory);
   Router.Register('GET',    '/entries/count',          HandleEntriesCount);