Add client-side note encryption

- WebCrypto keyring (PBKDF2 600k + AES-GCM master key) and per-note/per-image keys
- Encrypt/decrypt commands convert the note and its own images, deleting the originals
- Unlock, setup and change-password dialogs; manual lock; lock on page close
- Encrypted images are decrypted to blob URLs; pasted images are encrypted before upload
- Rewrite image links in the browser when renaming an encrypted note
- Skip local drafts for encrypted notes and confirm before closing with unsaved changes
- Show encrypted notes as locked with an explanation outside secure contexts

web/src/app/Workspace.vue

@@ -3,6 +3,8 @@ import { computed, onBeforeUnmount, onMounted } from 'vue'
 import { api } from './api'
 import { registerCommand } from './commands'
 import EditorPane from './EditorPane.vue'
+import { keyState } from './encryption'
+import KeyDialog from './KeyDialog.vue'
 import Icon from './Icon.vue'
 import NoteBanner from './NoteBanner.vue'
 import QuickSwitcher from './QuickSwitcher.vue'
@@ -67,5 +69,6 @@ onBeforeUnmount(() => {
     </main>
     <QuickSwitcher v-if="ws.switcher !== null" />
     <TrashDialog v-if="ws.trashOpen" @close="ws.trashOpen = false" />
+    <KeyDialog v-if="keyState.dialog" :key="keyState.dialog" />
   </div>
 </template>