Switching the API-key encryption mode no longer moves keys. The on-disk
envelope now retains passphrase material (kdf/verifier/keys) even while
Obsidian secret storage is active, so the two stores coexist and `mode` is
just the active-store flag.
Key transfer is now an explicit, separate action presented as Copy (the
source is kept, so it is a copy, not a move):
- setEncryptionMode: switch active method only, no transfer
- copyKeys: duplicate inactive -> active, source untouched
- clearKeys(mode): wipe one method's saved keys
- unlockPassphraseStore: unlock the snapshot regardless of active mode
- countStoredKeys / EncryptionStatus.passphraseConfigured for the UI
Settings tab: the mode dropdown is now a pure switch; new Copy and Clear
buttons (behind a new generic ConfirmModal) handle key material with a
copied/cleared count Notice. changePassphrase is a direct within-passphrase
re-key. Docs updated (SECRETS.md, CLAUDE.md, wiki).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fix Obsidian secret storage detection failing on all platforms.
app.secretStorage.setSecret rejects any id that is not lowercase
alphanumeric + dashes, so the colon-namespaced ids and the
underscore self-test id made the availability probe throw and report
secretStorage unavailable on every platform. Switch all secret ids
(namespace separator, self-test id, per-profile key ids) to
dash-joined form.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
