feat: upgrade toolchain and soften sync recovery after network blips

Bump Vite 8, matrix-js-sdk, and related deps; fix immer/vanilla-extract imports for new majors. Replace blocking sync error dialog with background recovery on wake/offline, and disable Vite auto-open in dev. Add feature handoff documentation index.

docs/handoff/features/e2e-and-devices/HANDOFF.md

@@ -0,0 +1,92 @@
+# E2E encryption & devices — handoff
+
+## Summary
+
+End-to-end encryption support via matrix-js-sdk crypto store: device verification, cross-signing, secret storage, key backup/export, and session management. Critical for secure DM and encrypted rooms.
+
+## User-facing behavior
+
+- Verify new logins / other sessions
+- Export room keys backup (`paarrot-keys.txt`)
+- Restore backup after verification
+- View and rename devices; logout remote sessions
+- Unverified sessions tab in sidebar
+
+## Architecture
+
+```
+secretStorageKeys.ts + cryptoCallbacks
+Devices.tsx, Verification.tsx, LocalBackup.tsx
+DeviceVerification.tsx — incoming verification
+BackupRestore.tsx — auto restore on verify
+useSecretStorage, useKeyBackup, useVerificationRequest hooks
+```
+
+## Key files
+
+| Path | Role |
+|------|------|
+| `cinny/src/client/secretStorageKeys.ts` | SSSS key handling |
+| `cinny/src/app/features/settings/devices/Devices.tsx` | Device list |
+| `cinny/src/app/features/settings/devices/Verification.tsx` | Verification UI |
+| `cinny/src/app/features/settings/devices/LocalBackup.tsx` | Key export |
+| `cinny/src/app/features/settings/devices/OtherDevices.tsx` | Remote sessions |
+| `cinny/src/app/components/DeviceVerification.tsx` | Incoming verify modal |
+| `cinny/src/app/components/BackupRestore.tsx` | Auto restore |
+| `cinny/src/app/components/SecretStorage.tsx` | Passphrase setup |
+| `cinny/src/app/hooks/useSecretStorage.ts` | Secret storage API |
+| `cinny/src/app/hooks/useKeyBackup.ts` | Backup API |
+| `cinny/src/app/pages/client/sidebar/UnverifiedTab.tsx` | Unverified badge |
+
+## Data model
+
+| Store | Purpose |
+|-------|---------|
+| IndexedDB crypto | Olm account, Megolm sessions |
+| SSSS | Cross-signing keys, backup key |
+| Matrix account data | `m.cross_signing.*`, `m.secret_storage.*` |
+
+## Dependencies
+
+- matrix-js-sdk crypto module
+- Secure random / Web Crypto
+
+## Integration points
+
+- **matrix-client**: crypto store init in initMatrix
+- **authentication**: first login bootstrap
+- **user-settings**: devices tab
+
+## Testing
+
+### Manual
+
+1. Login second device; verify via emoji/SAS from first.
+2. Export keys backup; file downloads.
+3. Encrypted room: send message; decrypt on other device.
+4. Logout remote session from devices list.
+
+### Automated
+
+- None
+
+## Known issues & gotchas
+
+- `handlingKeyConflict` in initMatrix on duplicate device keys
+- Logout clears crypto store — must re-verify
+- Backup passphrase loss = message history loss
+
+## Future work
+
+- Dehydrated devices support
+- Better recovery key UX
+
+## Related docs
+
+- [matrix-client HANDOFF](../matrix-client/HANDOFF.md)
+- [user-settings HANDOFF](../user-settings/HANDOFF.md)
+
+## Add your extra things here
+
+- Local backup filename: `paarrot-keys.txt` in LocalBackup.tsx
+- `ReceiveSelfDeviceVerification` route component in Router.tsx