docs(user): add user_docs/ end-user guide (12 pages)

A friendly, task-oriented guide for non-technical users: README index,
getting-started, concepts, items, passwords-and-generators, totp,
attachments-and-documents, organizing, sync-and-backup, the-browser-extension,
recovery, faq. Every command/flag derived from the actual CLI surface
(`relicario --help` tree) and real extension behavior — no invented flags.
Org item-type parity is covered high-level pending the v0.8.1 B/C merge
(two TODO markers left for the rebase).

user_docs/sync-and-backup.md

@@ -0,0 +1,110 @@
+# Syncing across devices & backing up
+
+This page covers how to keep your vault in sync across machines, how to create a portable encrypted backup, and why you need more than just your git remote to have a full backup.
+
+---
+
+## Syncing your vault between devices
+
+Relicario stores your vault in a git repo. Every item you add, edit, or delete is committed there. To push your latest changes to another machine (or pull a teammate's changes), run:
+
+```
+relicario sync
+```
+
+Under the hood, this does a `git pull --rebase` followed by a push to your configured git remote — the same remote you set up when you initialized your vault. Any machine that has the vault cloned and a copy of your reference image can sync and stay up to date.
+
+**Check what's in your vault at a glance:**
+
+```
+relicario status
+```
+
+This prints a summary: how many items and attachments you have, and the timestamp of the last commit.
+
+---
+
+## Why your git remote alone is NOT a full backup
+
+Here is the catch: your reference image — the photo that carries your second factor — is **gitignored**. It never gets committed to your git repo, by design. If someone stole your git remote, they still could not decrypt anything without that image.
+
+But that also means: **if you back up only your git remote and lose your reference image, you cannot unlock your vault.** The two factors travel separately by design.
+
+A complete backup has two parts:
+1. Your git remote (all the encrypted vault data).
+2. A safe copy of your reference image (the second factor).
+
+---
+
+## Creating a portable encrypted backup
+
+For the safest kind of backup — one you can carry on a USB drive or store in a separate location — use `relicario backup export`. This packs your entire vault into a single encrypted `.relbak` file. You set a **separate backup passphrase** that is independent of your vault passphrase, so the `.relbak` file can be kept and shared separately without revealing your vault credentials.
+
+**Export a backup:**
+
+```
+relicario backup export vault-backup.relbak
+```
+
+You will be prompted to set a backup passphrase. This is not the same as your vault passphrase — choose something strong and store it safely.
+
+**Include your reference image in the backup** (making it fully self-contained):
+
+```
+relicario backup export vault-backup.relbak --include-image
+```
+
+With `--include-image`, the `.relbak` file contains everything needed to restore and unlock the vault. If your reference image lives somewhere other than the default `reference.jpg` in the vault directory, point to it explicitly:
+
+```
+relicario backup export vault-backup.relbak --include-image --image /path/to/your/reference.jpg
+```
+
+**Skip the git history** (smaller file, useful for quick snapshot backups):
+
+```
+relicario backup export vault-backup.relbak --no-history
+```
+
+**Restore from a backup:**
+
+```
+relicario backup restore vault-backup.relbak
+```
+
+Or restore into a specific directory:
+
+```
+relicario backup restore vault-backup.relbak /path/to/new-vault/
+```
+
+The target directory must not already contain a `.relicario/` folder — Relicario will stop and tell you if it does.
+
+---
+
+## Importing from LastPass
+
+If you are migrating from LastPass, Relicario can import your data directly from a LastPass CSV export. Unlock your vault first, then run:
+
+```
+relicario import lastpass lastpass-export.csv
+```
+
+Each row in the CSV becomes a new item. If a row cannot be parsed, it is skipped and the reason is printed to the terminal — the rest of the import continues. Title collisions are kept as separate items (no automatic deduplication).
+
+---
+
+## Backup checklist
+
+> **Before you feel safe, make sure you have all four of these:**
+
+- [ ] **Your git remote** is reachable and has your latest sync (`relicario sync` before stepping away from a machine).
+- [ ] **A safe copy of your reference image** stored somewhere independent of the vault — a USB drive, an encrypted cloud folder, or a printed recovery QR (see [Recovery](recovery.md)).
+- [ ] **Optionally, a `.relbak` file with `--include-image`** stored somewhere offsite. This is the most convenient full restore path — one file, one backup passphrase.
+- [ ] **Your vault passphrase** memorized. There is no reset and no backdoor.
+
+For the full picture on what happens if you lose a factor, and how to generate a recovery QR for your reference image, see [Recovery](recovery.md).
+
+---
+
+**Next:** [The browser extension](the-browser-extension.md)