feat: native save + auto-backup + folder customization + attachments + UX bundle

- File: native Save As dialog via Bridge.saveFile (replaces WebView2
  browser download popup) for encrypted JSON + CSV exports.
- Auto-backup: silent periodic encrypted JSON to a chosen folder,
  user-set interval + retention, separate DPAPI-stored password, runs
  5s after unlock if due. New file/* bridge cmds (folder/pick,
  file/write, file/listMatch, file/delete).
- Folders: per-folder color + icon (8-swatch palette, 8 icon presets),
  drag-reorder via HTML5 DnD with insert-line indicators, edit pencil
  on hover. New POST /folders/reorder + PUT /folders/{name}. Folder
  chip on cards inherits custom icon + color.
- Recently used: vault_entries.accessed_at + POST /entries/{id}/touch
  (debounced 2s), sidebar Tools entry showing top-10 by accessed_at.
- Encrypted attachments: per-entry file storage (5MB cap), AES-GCM
  with vault key, native Save As download, paperclip upload in
  slideover. New entry_attachments table + PM.Handler.Attachments.
- Password expiry: vault_entries.password_changed_at (conditional bump
  via SQL CASE only when ciphertext differs), passwordExpiryDays
  setting, "Aged" badge on cards + matching Filters chip.
- Recovery: Print button on generated code modal (A4 printable sheet
  via @media print, code in 32px monospace + instructions).
- Audit log viewer (sidebar Tools, GET /audit with pagination cursor).
- Plaintext CSV export + Filters dropdown with 9 predicates.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Source/PM.Database.pas

@@ -208,6 +208,28 @@ begin
   FConn.ExecSQL(
     'CREATE INDEX IF NOT EXISTS idx_history_entry ' +
     '  ON entries_password_history(entry_id, changed_at DESC)');
+  // Per-entry encrypted file attachments (PDFs, images of backup codes,
+  // etc.). encrypted_blob is the AES-GCM ciphertext of the raw file bytes,
+  // base64-encoded. Filename + mime + size_bytes are stored in cleartext
+  // for the listing UI — knowingly leaked metadata in exchange for not
+  // having to decrypt every entry on list render.
+  FConn.ExecSQL(
+    'CREATE TABLE IF NOT EXISTS entry_attachments (' +
+    '  id INTEGER PRIMARY KEY AUTOINCREMENT,' +
+    '  user_id INTEGER NOT NULL,' +
+    '  entry_id INTEGER NOT NULL,' +
+    '  filename TEXT NOT NULL,' +
+    '  mime TEXT,' +
+    '  size_bytes INTEGER NOT NULL,' +
+    '  encrypted_blob TEXT NOT NULL,' +
+    '  iv TEXT NOT NULL,' +
+    '  created_at DATETIME DEFAULT CURRENT_TIMESTAMP,' +
+    '  FOREIGN KEY (user_id)  REFERENCES users(id)         ON DELETE CASCADE,' +
+    '  FOREIGN KEY (entry_id) REFERENCES vault_entries(id) ON DELETE CASCADE' +
+    ')');
+  FConn.ExecSQL(
+    'CREATE INDEX IF NOT EXISTS idx_attachments_entry ' +
+    '  ON entry_attachments(entry_id)');
 end;
 
 function TPMDatabase.ColumnExists(const ATable, AColumn: string): Boolean;
@@ -275,6 +297,22 @@ begin
   // Fetched on demand by the Delphi favicon proxy when the user opts in.
   // NULL = no icon cached → JS falls back to the first-letter avatar.
   AddColumnIfMissing('vault_entries', 'icon_b64',          'TEXT');
+  // Tracked client-side via POST /entries/:id/touch on copy/open. Powers
+  // the sidebar "Recent" view. NULL = never accessed since the column
+  // landed (legacy rows).
+  AddColumnIfMissing('vault_entries', 'accessed_at',       'DATETIME');
+  // Bumped to CURRENT_TIMESTAMP only when encrypted_password actually
+  // changes (distinct from updated_at which fires on any edit). Powers
+  // the "aged password" badge. Legacy rows: NULL → JS falls back to
+  // updated_at, then created_at.
+  AddColumnIfMissing('vault_entries', 'password_changed_at', 'DATETIME');
+  // Per-folder customisation. NULL = no override → JS uses the default
+  // accent + i-folder symbol.
+  AddColumnIfMissing('folders',       'color',             'TEXT');
+  AddColumnIfMissing('folders',       'icon',              'TEXT');
+  // Manual sort order from drag-reorder. 0 = legacy/never reordered →
+  // falls back to alphabetical secondary sort in GET /folders.
+  AddColumnIfMissing('folders',       'sort_order',        'INTEGER DEFAULT 0');
   AddColumnIfMissing('users',         'hash_algo',         'TEXT DEFAULT ''pbkdf2''');
   // PBKDF2 iteration count per user. Legacy rows (predating this column)
   // default to 100000 — the value used by api.php / the early Delphi build.