revert: restore entire src/ from pre-doc-scanner commit (e4b44a7)

Going back to a known-good baseline. This version had:
- Working reveal mode with CSS Highlight API
- Working substitution (fetch + XHR hooks)
- Smart patterns (names, emails, phones, usernames)
- Encryption/sync (password, TOTP, WebAuthn)
- Multiple identity profiles
- Activity log
- Secret scanner
- Auto-detect PII warnings
- Pre-send PII detection

Kept current manifests (UUID, data_collection_permissions, version).
No renames applied — uses original naming (secretScanning, PPI, etc).
Will re-apply renames and new features from this working base.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT

src/lib/sync.js

@@ -12,9 +12,8 @@
  * 5. Custom HTTP endpoint — any URL supporting GET + PUT (WebDAV,
  *    self-hosted server, cloud function, etc.).
  *
- * Encryption: all sync channels REQUIRE encryption with a password
- * (AES-256-GCM) and/or TOTP verification. Syncing without encryption
- * is not permitted — users must set up encryption before enabling sync.
+ * Encryption: all sync channels can optionally encrypt data with a
+ * password (AES-256-GCM) and/or require TOTP verification.
  * Authentication is cached with a configurable TTL so the user only
  * needs to authenticate when the cache expires and new data exists.
  *
@@ -371,9 +370,6 @@ const SilentSendSync = {
     const StorageModule = (await import('./storage.js')).default;
     await StorageModule.decryptAllData();
 
-    // Disable all sync channels since encryption is mandatory for sync
-    await StorageModule.saveSettings({ browserSync: false });
-
     await api.storage.local.remove('ss_sync_encryption');
     await SilentSendCrypto.clearCachedKey();
     await SilentSendCrypto.clearWebAuthnCredential();
@@ -419,7 +415,7 @@ const SilentSendSync = {
    */
   async _encryptForSync(data) {
     const config = await this._getSyncEncryption();
-    if (!config?.enabled) return { data: null, encrypted: false, needsEncryption: true };
+    if (!config?.enabled) return { data, encrypted: false };
 
     const keyInfo = await this._getEncryptionKey();
     if (!keyInfo) {
@@ -583,15 +579,12 @@ const SilentSendSync = {
   async exportSyncCode() {
     const data = await this._getAllData();
 
-    // Encrypt (mandatory)
+    // Encrypt if enabled
     const result = await this._encryptForSync(data);
-    if (result.needsEncryption) {
-      return { needsEncryption: true };
-    }
     if (result.needsAuth) {
       return { needsAuth: true };
     }
-    const payload = result.data;
+    const payload = result.data || data;
 
     const json = JSON.stringify(payload);
     return btoa(unescape(encodeURIComponent(json)));
@@ -647,10 +640,10 @@ const SilentSendSync = {
     try {
       const data = await this._getAllData();
 
-      // Encrypt (mandatory)
+      // Encrypt if enabled
       const result = await this._encryptForSync(data);
-      if (result.needsEncryption || result.needsAuth) return; // skip — encryption required
-      const payload = result.data;
+      if (result.needsAuth) return; // silently skip — will sync on next auth
+      const payload = result.data || data;
 
       const json = JSON.stringify(payload);
 
@@ -716,15 +709,12 @@ const SilentSendSync = {
     try {
       const data = await this._getAllData();
 
-      // Encrypt (mandatory)
+      // Encrypt if enabled
       const encResult = await this._encryptForSync(data);
-      if (encResult.needsEncryption) {
-        return { success: false, needsEncryption: true, reason: 'Encryption must be enabled before syncing.' };
-      }
       if (encResult.needsAuth) {
         return { success: false, needsAuth: true, reason: 'Authentication required.' };
       }
-      const payload = encResult.data;
+      const payload = encResult.data || data;
 
       const content = JSON.stringify(payload, null, 2);
       const stored = await api.storage.local.get('ss_gist_id');
@@ -820,13 +810,10 @@ const SilentSendSync = {
       const data = await this._getAllData();
 
       const encResult = await this._encryptForSync(data);
-      if (encResult.needsEncryption) {
-        return { success: false, needsEncryption: true, reason: 'Encryption must be enabled before syncing.' };
-      }
       if (encResult.needsAuth) {
         return { success: false, needsAuth: true, reason: 'Authentication required.' };
       }
-      const payload = encResult.data;
+      const payload = encResult.data || data;
 
       const resp = await fetch(url, {
         method,