feat(v1.3.0): add ephemeral session-key encryption for sensitive state

- Add src/lib/sessionCrypto.ts with AES-GCM-256 session keys
- Integrate into Backup flow: auto-clear plaintext mnemonic after QR gen
- Add Lock/Clear button to destroy key and clear all state
- Add cleanup on component unmount
- Fix unused imports and TypeScript strict mode errors

AGENTS.md

@@ -1,53 +0,0 @@
-# SeedPGP Agent Brief (read first)
-
-## What this repo is
-
-SeedPGP: a client-side BIP39 mnemonic encryption web app.
-Goal: add features without changing security assumptions or breaking GH Pages deploy.
-
-## Non-negotiables
-
-- Small diffs only: one feature slice per PR (1-5 files if possible).
-- No big code dumps; propose plan first, then implement.
-- Never persist secrets (mnemonic, passphrases, private keys) to localStorage/sessionStorage.
-- Prefer “explain what you found in the repo” over guessing.
-
-## How to run
-
-- Install deps: `bun install`
-- Dev: `bun run dev`
-- Build: `bun run build`
-- Tests/lint (if present): `bun run test`, `bun run lint`, `bun run typecheck`
-
-## Repo map (confirm/update)
-
-- UI entry: `src/main.tsx`
-- Components: `src/components/`
-- Core logic/types: `src/lib/`
-
-## Deploy
-
-There is a deploy script (see `scripts/deploy.sh`) and a separate public repo for built output.
-
-## Required workflow for every task
-
-1) Repo study: identify entry points + relevant modules, list files to touch.
-2) Plan: smallest vertical slice, with acceptance criteria.
-3) Implement: code + minimal tests or manual verification steps.
-4) Evidence: paste command output (build/test) and note any tradeoffs.
-
-## Security Architecture (v1.3.0+)
-
-- **Session-key encryption**: Ephemeral AES-GCM-256 key (non-exportable) encrypts sensitive state
-- **Auto-clear**: Plaintext mnemonic cleared from UI immediately after QR generation
-- **Encrypted cache**: Only ciphertext stored in React state; key lives in memory only
-- **Lock/Clear**: Manual cleanup destroys session key + clears all state
-- **Lifecycle**: Session key auto-destroyed on page close/refresh
-
-## Module: src/lib/sessionCrypto.ts
-
-- `getSessionKey()` - Generates/returns non-exportable AES-GCM key (idempotent)
-- `encryptJsonToBlob(obj)` - Encrypts to {v, alg, iv_b64, ct_b64}
-- `decryptBlobToJson(blob)` - Decrypts back to original object
-- `destroySessionKey()` - Drops key reference for GC
-- Test: `await window.runSessionCryptoTest()` (DEV only)

package.json

@@ -6,7 +6,8 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc && vite build",
-    "preview": "vite preview"
+    "preview": "vite preview",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
     "html5-qrcode": "^2.3.8",