Vault card — a new card type that stores notes and links behind an
encrypted wall. Add it from the toolbar or the right-click menu, then choose
a password or a 3×3 swipe pattern. Encryption is zero-knowledge and
client-side (WebCrypto PBKDF2-SHA256 → AES-256-GCM): only the ciphertext
envelope is ever persisted to localStorage/Supabase or broadcast to space
members, so neither the server nor other collaborators can read the contents
without the secret. A forgotten secret is unrecoverable by design (warned at
creation). Viewers can unlock and read if they know the secret but cannot
edit; the AI board context sees only the vault's title, marked as encrypted.
New: lib/vault-crypto.ts, components/PatternPad.tsx,
components/cards/VaultCard.tsx. No DB migration — the envelope rides in the
existing cards.data jsonb.
