Add client-side note encryption

- WebCrypto keyring (PBKDF2 600k + AES-GCM master key) and per-note/per-image keys
- Encrypt/decrypt commands convert the note and its own images, deleting the originals
- Unlock, setup and change-password dialogs; manual lock; lock on page close
- Encrypted images are decrypted to blob URLs; pasted images are encrypted before upload
- Rewrite image links in the browser when renaming an encrypted note
- Skip local drafts for encrypted notes and confirm before closing with unsaved changes
- Show encrypted notes as locked with an explanation outside secure contexts

web/src/editor/widgets.ts

@@ -123,6 +123,7 @@ export class ImageWidget extends WidgetType {
   constructor(
     readonly src: string,
     readonly alt: string,
+    readonly load: (src: string) => Promise<string> | null = () => null,
   ) {
     super()
   }
@@ -133,7 +134,9 @@ export class ImageWidget extends WidgetType {
     const wrap = document.createElement('span')
     wrap.className = 'cm-rm-image'
     const img = document.createElement('img')
-    img.src = this.src
+    const loading = this.load(this.src)
+    if (loading) loading.then((url) => (img.src = url), () => img.dispatchEvent(new Event('error')))
+    else img.src = this.src
     img.alt = this.alt
     img.loading = 'lazy'
     img.decoding = 'async'