fix: vault paths, TOTP caching, and keyboard nav on filtered list

- Fix .idfoto/ prefix for salt and params.json in vault.ts
- Cache TOTP secrets by entry ID to avoid re-fetching every second
- Fix keyboard navigation to use filtered entries, not unfiltered
- Add window.close() on Escape from entry list

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

extension/src/service-worker/index.ts

@@ -16,6 +16,8 @@ let masterKey: Uint8Array | null = null;
 let manifest: Manifest | null = null;
 let gitHost: GitHost | null = null;
 let wasmReady = false;
+// Cache TOTP secrets by entry ID to avoid re-fetching the entry every second
+const totpSecretCache: Map<string, string> = new Map();
 
 // --- WASM initialization ---
 
@@ -121,6 +123,7 @@ async function handleMessage(req: Request): Promise<Response> {
     case 'lock':
       masterKey = null;
       manifest = null;
+      totpSecretCache.clear();
       return { ok: true };
 
     // --- Entries ---
@@ -220,11 +223,18 @@ async function handleMessage(req: Request): Promise<Response> {
     case 'get_totp': {
       if (!masterKey || !gitHost) return { ok: false, error: 'Vault is locked' };
       const w = await initWasm();
-      const entry = await vault.fetchAndDecryptEntry(gitHost, masterKey, req.id);
-      if (!entry.totp_secret) return { ok: false, error: 'No TOTP secret for this entry' };
+
+      // Use cached TOTP secret to avoid re-fetching the entry every second
+      let totpSecret = totpSecretCache.get(req.id);
+      if (!totpSecret) {
+        const entry = await vault.fetchAndDecryptEntry(gitHost, masterKey, req.id);
+        if (!entry.totp_secret) return { ok: false, error: 'No TOTP secret for this entry' };
+        totpSecret = entry.totp_secret;
+        totpSecretCache.set(req.id, totpSecret);
+      }
 
       const now = Math.floor(Date.now() / 1000);
-      const code = w.generate_totp(entry.totp_secret, BigInt(now));
+      const code = w.generate_totp(totpSecret, BigInt(now));
       const remaining = 30 - (now % 30);
 
       return { ok: true, data: { code, remaining_seconds: remaining } };

extension/src/service-worker/vault.ts

@@ -28,8 +28,8 @@ export interface VaultMeta {
 
 /// Read the vault salt and KDF params from the git repo.
 export async function fetchVaultMeta(git: GitHost): Promise<VaultMeta> {
-  const saltBytes = await git.readFile('salt');
-  const paramsRaw = await git.readFile('params.json');
+  const saltBytes = await git.readFile('.idfoto/salt');
+  const paramsRaw = await git.readFile('.idfoto/params.json');
   const paramsJson = new TextDecoder().decode(paramsRaw);
   return { salt: saltBytes, paramsJson };
 }