- Remove CSP meta tag from index.html (breaks Vite HMR, should be
set via HTTP headers in production nginx instead)
- isCryptoEnabled() now checks crypto.subtle is available (undefined
over HTTP on non-localhost origins)
- Add try/catch + error feedback to passphrase submit flow
- PassphraseDialog accepts error prop, focuses input on visible
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>