fix: WebAuthn as primary re-auth, key persists indefinitely

- CryptoKey now persists in IndexedDB forever — never auto-deleted
- TTL controls when re-verification is needed, not key lifetime
- WebAuthn is the primary re-auth method (not a post-expiry fallback)
- Password only needed once per device (first-time setup)
- Added needsReverification() and markVerified() to crypto.js
- Auth prompt adapts message: first-device vs re-verify vs decrypt
- Biometric button hidden on first-device setup (no credential yet)

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

src/options/options.html

@@ -162,7 +162,7 @@
 
           <!-- Auth prompt (shown when key cache expired and sync needs decryption) -->
           <div id="syncAuthPrompt" style="display:none;margin-top:10px;padding:10px;background:#fffbeb;border:1px solid #fcd34d;border-radius:6px">
-            <p style="font-size:12px;font-weight:500;margin:0 0 8px;color:#92400e">Authentication required — new sync data is available</p>
+            <p style="font-size:12px;font-weight:500;margin:0 0 8px;color:#92400e">Authentication required</p>
             <div style="display:flex;gap:8px;flex-wrap:wrap;align-items:end">
               <input type="password" id="syncAuthPassword" placeholder="Password" autocomplete="current-password"
                 style="flex:1;min-width:120px;font-size:12px;padding:5px 8px;border:1px solid #d1d5db;border-radius:6px">