- New src/lib/crypto/totp.js: native RFC 6238 TOTP using Web Crypto HMAC-SHA1
(no external crypto). base32Decode, extractSecret (bare base32 or otpauth://
URI), generateTotp, totpRemainingSeconds.
- Entries gain an optional encryptedTotpSecret, stored AES-GCM-encrypted like
passwords. schema.js createEntry/updateEntry/docs updated.
- Export/import re-key the TOTP secret alongside passwords when sealing with a
separate password, and decrypt/re-encrypt on import so TOTP survives moves.
- EntryForm: optional 'TOTP Secret (2FA)' field (base32 or otpauth:// URI).
- EntryDetail: live 6-digit TOTP display updating every second with a countdown
and urgency indicator, plus copy; guarded cleanup timer on unmount.
- Tests: RFC 6238 SHA-1 vectors (6 & 8 digit), base32/extractSecret, remaining
seconds, schema round-trip. 157 total pass.
- validateEntry no longer requires encryptedPassword; only title is required
(schema.js). encryptedPassword documented as optional.
- EntryForm: decrypt-guards empty password on edit; stores empty string (no
encryption) when the password field is blank; label is 'Password' (no *).
- EntryDetail: only renders the Password field when the entry has one;
decrypt guards empty.
- Tests: schema validation updated (password optional); 143 total pass.
