PWA offline support + client-side encryption

- Service worker: caches app shell, network-first for HTML
- manifest.json for installable PWA
- IndexedDB: cache files locally, queue pending saves
- Offline fallback: open cached files when server unreachable
- Sync pending changes on reconnect (online event)
- Client-side AES-256-GCM encryption lib (PBKDF2 key derivation)
- Ready for Private Vault feature

frontend/src/App.vue

@@ -247,6 +247,7 @@ import FileTree from './components/FileTree.vue'
 import MilkdownEditor from './components/MilkdownEditor.vue'
 import { api, setToken } from './lib/api.js'
 import { renderMarkdown } from './lib/markdown.js'
+import { cacheFile, getCachedFile, addPendingChange, getPendingChanges, clearAllPending } from './lib/offline.js'
 
 const authenticated = ref(false)
 const email = ref('')
@@ -318,12 +319,28 @@ async function login() {
     loadFiles()
     loadShared()
     loadRemotes()
+    syncPending()
     if (isAdmin.value) loadUsers()
+    // Sync pending changes when coming back online
+    window.addEventListener('online', syncPending)
   } catch (e) {
     loginError.value = 'Invalid credentials'
   }
 }
 
+async function syncPending() {
+  const pending = await getPendingChanges()
+  for (const item of pending) {
+    try {
+      await api('/api/files/write', { path: item.path, content: item.content })
+    } catch { break }
+  }
+  if (pending.length) {
+    await clearAllPending()
+    loadFiles()
+  }
+}
+
 // ─── Files ───────────────────────────────────────────────────────────────────
 
 async function loadFiles() {
@@ -357,10 +374,24 @@ function filterTree(items, query) {
 
 async function openFile(path) {
   if (isDirty.value && !confirm('Discard unsaved changes?')) return
-  const res = await api('/api/files/read', { path })
-  currentFile.value = path
-  content.value = res.content
-  fileMeta.value = res.created ? `Created: ${formatDate(res.created)}` : ''
+  try {
+    const res = await api('/api/files/read', { path })
+    currentFile.value = path
+    content.value = res.content
+    fileMeta.value = res.created ? `Created: ${formatDate(res.created)}` : ''
+    cacheFile(path, res.content)
+  } catch (e) {
+    // Offline fallback
+    const cached = await getCachedFile(path)
+    if (cached !== null) {
+      currentFile.value = path
+      content.value = cached
+      fileMeta.value = '(offline cache)'
+    } else {
+      alert('File unavailable offline')
+      return
+    }
+  }
   isDirty.value = false
   view.value = 'files'
   showHistory.value = false
@@ -372,21 +403,32 @@ async function openFile(path) {
 
 async function saveFile() {
   if (!currentFile.value) {
-    // No file open — prompt to create one
     const name = prompt('Save as (e.g. notes.md):')
     if (!name) return
     let path = name
     if (!path.endsWith('.md') && !path.endsWith('.txt')) {
       path += '.md'
     }
-    await api('/api/files/create', { path, content: content.value })
-    currentFile.value = path
-    isDirty.value = false
-    await loadFiles()
+    try {
+      await api('/api/files/create', { path, content: content.value })
+      currentFile.value = path
+      isDirty.value = false
+      await loadFiles()
+    } catch (e) {
+      await addPendingChange(path, content.value)
+      currentFile.value = path
+      isDirty.value = false
+    }
+    cacheFile(currentFile.value, content.value)
     setTimeout(checkGitStatus, 1000)
     return
   }
-  await api('/api/files/write', { path: currentFile.value, content: content.value })
+  try {
+    await api('/api/files/write', { path: currentFile.value, content: content.value })
+  } catch (e) {
+    await addPendingChange(currentFile.value, content.value)
+  }
+  cacheFile(currentFile.value, content.value)
   isDirty.value = false
   setTimeout(checkGitStatus, 1000)
 }