feat: design system overhaul — sidebar, AI chats, settings, brainstorm, color cleanup

- Sidebar: dynamic brand-accent colors, brainstorm section restyled
- AI chat general: popup panel with expand/collapse, hides when contextual AI open
- AI chat contextual: tabs reordered (Actions first), X close button, height fix
- Settings: all tabs restyled, 6 new color presets (sage, terracotta, iron, etc.)
- Global color cleanup: emerald/orange hardcoded → brand-accent dynamic
- Brainstorm page: orange → brand-accent throughout
- PageEntry animation component added to key pages
- Floating AI button: bg-brand-accent instead of hardcoded black
- i18n: all 15 locales updated with new AI/billing keys
- Billing: freemium quota tracking, BYOK, stripe subscription scaffolding
- Admin: integrated into new design
- AGENTS.md + CLAUDE.md project rules added

memento-note/tests/unit/crypto.test.ts

@@ -0,0 +1,36 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { decryptApiKey, encryptApiKey, hashApiKey } from '@/lib/crypto';
+
+const TEST_KEY = 'a'.repeat(32);
+
+describe('crypto', () => {
+  const prev = process.env.MASTER_ENCRYPTION_KEY;
+
+  beforeEach(() => {
+    process.env.MASTER_ENCRYPTION_KEY = TEST_KEY;
+  });
+
+  afterEach(() => {
+    process.env.MASTER_ENCRYPTION_KEY = prev;
+  });
+
+  it('round-trips encrypt and decrypt', async () => {
+    const plain = 'sk-test-byok-key-12345';
+    const payload = await encryptApiKey(plain);
+    expect(payload).not.toContain(plain);
+    expect(await decryptApiKey(payload)).toBe(plain);
+  });
+
+  it('hashApiKey is stable', () => {
+    const h1 = hashApiKey('sk-abc');
+    const h2 = hashApiKey('sk-abc');
+    expect(h1).toBe(h2);
+    expect(h1).not.toBe(hashApiKey('sk-xyz'));
+  });
+
+  it('fails decrypt with wrong master key', async () => {
+    const payload = await encryptApiKey('secret');
+    process.env.MASTER_ENCRYPTION_KEY = 'b'.repeat(32);
+    await expect(decryptApiKey(payload)).rejects.toThrow();
+  });
+});