Optional end-to-end encryption in NoteLace

Added opt-in end-to-end encryption: an Argon2id passphrase vault with a 24-word recovery phrase, the device key wrapped in the OS keychain. It encrypts note content and image attachments at rest and over sync. Off by default — it’s a real commitment (lose the phrase, lose the notes), so it should be a deliberate choice, not a surprise.