- Remove CSP meta tag from index.html (breaks Vite HMR, should be set via HTTP headers in production nginx instead) - isCryptoEnabled() now checks crypto.subtle is available (undefined over HTTP on non-localhost origins) - Add try/catch + error feedback to passphrase submit flow - PassphraseDialog accepts error prop, focuses input on visible Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>