Frontend review fixes: copy buttons, error toasts, page-reset, notes row, localized gate errors ...

- Extension SHA card and token-modal copy buttons wired to GnCopyButton
  text (was :value — dead button); :label localized
- Create/save/export/reveal/token flows show error toasts instead of
  failing silently; failed create/save keeps the modal and user input
- Query debounce resets secretsPage when the search narrows
- History panel drops the misleading metadata block (show-details=false)
- Notes now visible in the detail panel (between category and tags) when
  the secret carries one; notes inputs widened 140 -> 255 chars
- Biometric gate failure/unavailability messages are i18n slugs
  (bio.*), rendered localized instead of raw English debug strings
- backups table formats size (KB) and CREATED timestamp
- vite dev proxy points at the real backend port 8018
- en/ru/uk dictionaries kept at full parity (223 keys)

Verified visually on 1280x900 and 390x844; console clean.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Session death drops the SPA onto the sign-in screen without a reload ...

Any 401 from any API call fires gncreds:unauthenticated; the App listens
and switches to the internal sign-in card immediately, so a finished
session (global auth logout, TTL, revoked session) is visible at once
instead of letting the app look alive while every request fails. api.js
also stops retrying 4xx answers — only network errors and 5xx are
retried, so a dead session is not re-sent three times with backoff.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Revoked tokens stop being invisible: popup plate + token ID, tokens table columns ...

Extension 0.2.2: a 401 from any API call flips a tokenInvalid flag that the
popup renders as a dedicated plate (same load, via status propagation from
the background, plus the pre-flagged check on popup open); the Settings
drawer shows the stored token's public ID so it can be matched against the
tokens table. Web: Tokens tab gains Public ID / Created / Last used columns.
Design pack v24 ships the new strings (en/uk/ru); served zips rehashed.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Splash over the empty shell on sign-in; extension v0.2.1 catches submit() logins ...

- App.vue gates on auth state: 'checking' renders a logo + spinner card
  until /me answers, so the shell never flashes empty before the
  sign-in screen appears; 'denied' -> sign-in card, 'ready' -> app.
- content.js: DLE-style <button onclick="submit();"> calls
  form.submit(), which fires no submit event - the login form's
  interceptor stayed silent (animaunt.org regression). Capture happens
  on the submit-button click and Enter too; duplicate captures within
  1.5s with identical credentials are dropped. Verified end-to-end on
  animaunt.org: modal login -> popup save card -> vault entry.
- Release 0.2.1: Makefile + extension manifest bumped, zips rebuilt
  and hashed into the deploy manifest for the download page.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Logout lands on the internal sign-in screen, no SSO auto-login ...

Nav-style flow: POST /auth/logout then reload the app — /me answers 401,
so the SPA shows its own sign-in gate (logo card with one button) instead
of bouncing to /auth/login, which silently re-authenticated through the
still-alive gnexus-auth session. OAuth now starts only from the explicit
"Sign in with GNEXUS" click; a non-401 failure on load keeps the old
redirect.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Settings page hosts the language switcher; profile-edit modal removed ...

The interface-language GnSelect now lives on the Settings page (Auto /
English / Українська / Русский) and applies on change, so the Edit-profile
modal — and the pencil button that opened it — are gone. The dead profile
slugs leave the dictionaries.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Web app: en/uk/ru localization, language picked from the backend ...

Tiny reactive i18n module (locale ref, t() with {param} interpolation and
ru/uk plural forms, flat per-area dictionaries, en fallback) instead of a
vue-i18n dependency. App.vue and SecretDetailPanel.vue migrate every
hardcoded string to message slugs; /me's locale_effective (settings
override -> auth account -> en) seeds the language on load, the profile
modal gains a language GnSelect (Auto/English/Українська/Русский) that
PATCHes /me and re-applies the effective locale, and <html lang> follows.

Co-Authored-By: Claude Code <noreply@anthropic.com>

UX fixes: pagination ellipsis, mobile layouts, tokens table, danger-zone radius ...

- Pagination re-collapses long page runs to "1 2 3 … 22" (AppPagination, same
  look as the kit's) for secrets, audit and admin users.
- Settings metrics: grid columns; metric cards stretch to the full track and
  stack one per row on mobile.
- Danger zone gets the standard 6px border radius.
- Revealed fields: one column on mobile, long values wrap instead of pushing
  the page into horizontal scroll.
- Secrets table on mobile becomes a card list: category stacks under the
  title, purpose column drops out, thead hidden.
- API tokens list is now a full-width table (Name / Scopes / actions).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Add PWA shell and a client-side biometric gate on secret reveal ...

PWA: hand-rolled service worker (public/sw.js, no build plugin) with a
precached shell, network-first navigations with a 4s timeout and an
inline offline page, and stale-while-revalidate for /assets and public
files that byte-compares in the background and replaces an entry only
when the server copy differs. API/auth/MCP/webhook traffic is never
intercepted or cached — cookie and secret responses stay out of cache
storage. manifest.webmanifest + theme-color + apple-touch-icon; icons
rasterized from the shield logo by tools/rasterize_icons.py (192/512,
any + maskable). SW registers in main.js under the same
secure-context condition the gate uses, with silent background update
ticks on visibility/online/15min.

Biometric gate (frontend/src/biometric.js): a platform-authenticator
passkey (Android fingerprints through BiometricPrompt, Touch ID,
Windows Hello) is enrolled opt-in from Settings; every reveal and
version reveal runs a fresh WebAuthn assertion with
userVerification:"required", whose clientData/authenticatorData/
signature are verified offline in the same browser against the stored
public key. The server never learns about biometrics — this is an
interface lock, not encryption. Disable requires the same proof, and
the toggle disables itself with an explanatory note on devices
without a platform authenticator.

Also fixes a pre-existing bug the verification run caught: the detail
panel's Hide button wrote `revealed.value = null` in the template,
where refs auto-unwrap, so the panel never returned to masked state.

Verified end to end with a CDP virtual authenticator: 16 checks cover
manifest/SW/offline shell/freshness/no-API-cache, enrollment, reveal
through the gate (HTTP 200), reveal blocked with no sensor, disable
refused without the sensor and allowed with it, and the disabled
toggle + note on a device without biometrics.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Polish custom views on kit 1.0: timeline, audit chain, modals ...

- Audit: the GnEmptyState's v-else bound to the GnPagination's v-if, so the
  phantom "No audit events" block rendered alongside a populated table; move
  pagination outside the loading/rows/empty chain and gate it explicitly.
- Timeline: spell out the text fallback inside the per-item slot (a truthy
  dynamic slot always overrides GnTimeline's item.text), humanize created_at
  to local "YYYY-MM-DD HH:mm" in history and audit, pluralize the field
  count, and draw a connector rail between markers.
- Modals/toasts: drop the app-side a-show/a-hide keyframes — kit 1.0 owns
  both transitions itself; align create-modal spacing to the kit's 15px
  rhythm and add a hairline separator between modal sections.

Verified with Playwright screenshots (history, audit, create modal
open/close/reopen) on the live server; no page errors.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Adopt shield keyhole logo, serve dist public assets from SPA fallback ...

gnexus-creds now has its own mark: a shield with a keyhole, drawn in the
gnexus-ui-kit language (dark tile, line-art strokes, square keyhole
terminal in the role color). Ship it as frontend/public/logo.svg, use it
in the navigation shell instead of the external gnexus.space PNG, and
register it as the SVG favicon.

The SPA fallback in main.py returned index.html for every unknown path,
so /logo.svg rendered the HTML shell instead of the image; serve real
files that exist in frontend/dist first and fall back only afterwards.
Also drop two unused imports flagged by ruff.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Update gnexus-ui-kit to 1.0.0, drop vendored GnModal, use kit tokens ...

Upgrade the git dependency to 1.0.0 (allow-git for npm 12, recorded in
frontend/.npmrc). The vendored GnModal.vue copy is no longer needed: the
kit's overlay transitions are fixed upstream via useOverlayTransition,
and the official component is API-identical. Replace the five hardcoded
palette hexes in styles.css with kit design tokens so theme swaps stay
one import away.

Also restate the form-group hint styles for .tag-input: GnTagInput
renders its hint outside .form-group, so the scoped .form-group
.input-info styles from kit 1.0 miss it and the hint was glued to the
field with no top margin.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Remove empty Install section from extension page ...

The install instructions block added no value and rendered empty;
drop it, keeping the build download cards and the API-token action.

Co-Authored-By: Claude <noreply@anthropic.com>

Add in-app extension download page ...

Distribute the gnexus-creds browser extension from the service itself.
Package Chrome and Firefox builds into extensions/dist/ with a manifest
describing version, checksums, and sizes; serve them via authenticated
FastAPI endpoints and surface a new Extension tab in the Vue UI with
download cards, SHA-256, and install instructions.

Co-Authored-By: Claude <noreply@anthropic.com>

Bump frontend version to 0.2.0

Style fixes: timeline hover, page-header layout, toolbar sort icon ...

- Disable timeline-card hover background/transform
- Fix page-header-compact: overflow initial, content row layout
- Move sort dropdown out of toolbar into actions row
- Replace sort button label with icon-only GnIconButton

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Apply gnexus-ui-kit 0.4.0 improvements: GnCopyButton, GnTagInput, GnSwitch, GnConfirmDialog, GnTooltip, GnUserCard ...

- Replace manual copy logic with GnCopyButton in SecretDetailPanel
- Replace comma-separated tag input with GnTagInput (array-based)
- Replace access checkboxes with GnSwitch for better UX
- Replace custom confirm modals with GnConfirmDialog
- Add GnTooltip to reveal/hide/edit action icons
- Replace admin table with GnUserCard grid layout
- Replace error paragraphs with GnAlert components
- Remove copiedFieldKey and copyValue custom logic
- Update form tags handling from string to array

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Production-ready rewrite: UI kit integration, admin backups, sorting, profile editing, and security hardening ...

- Frontend: complete rewrite using gnexus-ui-kit components (GnNavigationShell,
  GnTable, GnTimeline, GnModal, GnToastProvider, GnSkeleton, etc.)
- Frontend: browser route sync (/secrets/:id, /audit/:id), pagination,
  real-time search debounce, skeleton loading states, retry with backoff
- Frontend: profile editing modal, token creation with scope selection,
  import/export, settings metrics, admin users table
- Backend: backup/restore endpoints for PostgreSQL and SQLite via pg_dump/psql
- Backend: admin backup CRUD, file download endpoint
- Backend: stats endpoint, PATCH /me profile endpoint, CORS middleware,
  graceful shutdown logging
- Backend: table sorting (sort_by/sort_dir) in list_secrets
- Backend: OAuth return_to validation, rate limiting on sensitive endpoints
- MCP: validation fixes, tool description improvements, protocol cleanup
- Tests: 44 passing including new backup test suite
- Docker: add postgresql-client, backups volume, deployment docs
- Docs: backup/restore instructions in deployment guide

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Compact header search

Move search into page header

Add routes for secret detail pages

Sync tabs with browser routes

Split secrets list and detail views

Use table for secrets list

Show toast after copying values

Use dropdown for secret actions

Move metadata edit form to modal

Mask revealed fields by default

Improve modal close and revealed field actions

Improve create modal density and animation