Add PWA shell and a client-side biometric gate on secret reveal ...

PWA: hand-rolled service worker (public/sw.js, no build plugin) with a
precached shell, network-first navigations with a 4s timeout and an
inline offline page, and stale-while-revalidate for /assets and public
files that byte-compares in the background and replaces an entry only
when the server copy differs. API/auth/MCP/webhook traffic is never
intercepted or cached — cookie and secret responses stay out of cache
storage. manifest.webmanifest + theme-color + apple-touch-icon; icons
rasterized from the shield logo by tools/rasterize_icons.py (192/512,
any + maskable). SW registers in main.js under the same
secure-context condition the gate uses, with silent background update
ticks on visibility/online/15min.

Biometric gate (frontend/src/biometric.js): a platform-authenticator
passkey (Android fingerprints through BiometricPrompt, Touch ID,
Windows Hello) is enrolled opt-in from Settings; every reveal and
version reveal runs a fresh WebAuthn assertion with
userVerification:"required", whose clientData/authenticatorData/
signature are verified offline in the same browser against the stored
public key. The server never learns about biometrics — this is an
interface lock, not encryption. Disable requires the same proof, and
the toggle disables itself with an explanatory note on devices
without a platform authenticator.

Also fixes a pre-existing bug the verification run caught: the detail
panel's Hide button wrote `revealed.value = null` in the template,
where refs auto-unwrap, so the panel never returned to masked state.

Verified end to end with a CDP virtual authenticator: 16 checks cover
manifest/SW/offline shell/freshness/no-API-cache, enrollment, reveal
through the gate (HTTP 200), reveal blocked with no sensor, disable
refused without the sensor and allowed with it, and the disabled
toggle + note on a device without biometrics.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Adopt shield keyhole logo, serve dist public assets from SPA fallback ...

gnexus-creds now has its own mark: a shield with a keyhole, drawn in the
gnexus-ui-kit language (dark tile, line-art strokes, square keyhole
terminal in the role color). Ship it as frontend/public/logo.svg, use it
in the navigation shell instead of the external gnexus.space PNG, and
register it as the SVG favicon.

The SPA fallback in main.py returned index.html for every unknown path,
so /logo.svg rendered the HTML shell instead of the image; serve real
files that exist in frontend/dist first and fall back only afterwards.
Also drop two unused imports flagged by ruff.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Implement initial gnexus-creds MVP scaffold