feat(wallet): add encrypted local vault runtime

ui/app.js

@@ -28,7 +28,7 @@ const fallbackDashboard = {
 };
 
 const fallbackFeatures = [
-  ['Create/unlock wallet', 'Password, lock/unlock, encrypted local state', 'Modeled'],
+  ['Create/unlock wallet', 'Password, lock/unlock, encrypted local state', 'RuntimeImplemented'],
   ['Import/create accounts', 'Seed phrase, private key, JSON, watch-only', 'Modeled'],
   ['Multi-chain networks', 'Built-in, custom RPC, testnet, offline chain flags', 'Modeled'],
   ['Portfolio dashboard', 'Balances, NFTs, DeFi positions, activity', 'UiPrototype'],
@@ -117,6 +117,25 @@ function renderFeatures(features) {
   }).join('');
 }
 
+async function saveDemoVault() {
+  const passphrase = document.getElementById('vault-passphrase').value;
+  const output = document.getElementById('vault-status');
+  output.textContent = 'Encrypting demo vault…';
+  try {
+    const tauri = window.__TAURI__?.core;
+    if (!tauri) throw new Error('Tauri bridge unavailable in browser preview');
+    const status = await tauri.invoke('save_demo_wallet_vault', { passphrase, path: null });
+    output.textContent = `Encrypted with ${status.cipher} + ${status.kdf}: ${status.path}`;
+  } catch (error) {
+    output.textContent = String(error);
+  }
+}
+
+function wireVaultActions() {
+  const button = document.getElementById('save-vault');
+  if (button) button.addEventListener('click', saveDemoVault);
+}
+
 async function boot() {
   const [dashboard, features] = await Promise.all([
     invokeOrFallback('wallet_dashboard', fallbackDashboard),
@@ -124,6 +143,7 @@ async function boot() {
   ]);
   renderDashboard(dashboard);
   renderFeatures(features);
+  wireVaultActions();
 }
 
 boot();