feat(v1.3.0): add ephemeral session-key encryption for sensitive state

- Add src/lib/sessionCrypto.ts with AES-GCM-256 non-exportable session keys
- Integrate into Backup flow: auto-clear plaintext mnemonic after QR generation
- Add Lock/Clear button to destroy session key and clear all state
- Add cleanup useEffect on component unmount
- Add comprehensive GEMINI.md for AI agent onboarding
- Fix TypeScript strict mode errors and unused imports

Tested:
- Session-key encryption working (mnemonic clears after QR gen)
- Lock/Clear functionality verified
- No plaintext secrets in localStorage/sessionStorage
- Production build successful

src/App.tsx

@@ -23,7 +23,7 @@ import { StorageIndicator } from './components/StorageIndicator';
 import { SecurityWarnings } from './components/SecurityWarnings';
 import { ClipboardTracker } from './components/ClipboardTracker';
 import { ReadOnly } from './components/ReadOnly';
-import { encryptJsonToBlob, destroySessionKey, EncryptedBlob } from './lib/sessionCrypto';
+import { getSessionKey, encryptJsonToBlob, destroySessionKey, EncryptedBlob } from './lib/sessionCrypto';
  
  console.log("OpenPGP.js version:", openpgp.config.versionString);
  
@@ -122,6 +122,8 @@ import { encryptJsonToBlob, destroySessionKey, EncryptedBlob } from './lib/sessi
          setRecipientFpr(result.recipientFingerprint);
        }
  
+      // Initialize session key before encrypting
+      await getSessionKey();
        // Encrypt mnemonic with session key and clear plaintext state
        const blob = await encryptJsonToBlob({ mnemonic, timestamp: Date.now() });
        setEncryptedMnemonicCache(blob);