Secure Vault

Client-side AES, direct upload to Supabase Storage — plaintext never leaves your browser unencrypted.