- exportSelected(groupIds, vaultKey, exportPassword=''): plain JSON export unchanged when
no export password; when one is set, re-keys each entry's password to a key derived from
the export password and AES-256-GCM-seals the entire payload (titles/usernames/notes
protected too). Returns a { format: 'encrypted-export', salt, data } envelope.
- importAll() detects sealed exports and treats the supplied password as the EXPORT password,
so it may differ from any vault's master password. Wrong password rejects import instead of
silently skipping entries.
- ImportExport.svelte: optional 'separate password' field in the export dialog; import dialog's
field reworded as a generic file password covering both plain and sealed files.
- Tests for sealed export/import round-trip incl. wrong-password & missing-password rejects.
