feat: ШАГ 1 — Bridge HTTP-сервер для браузерного расширения

- internal/core/bridge/ — лёгкий HTTP-сервер на 127.0.0.1
  - POST /api/events — приём батча событий от расширения
  - GET /api/ping — healthcheck для расширения
  - X-Verstak-Secret — аутентификация по shared-secret
  - AutoGenPort — случайный порт если 9786 занят
- config.BridgeConfig — порт, секрет, auto_gen_port
- App: интеграция startBridge/stopBridge при open/close vault
- bindings_bridge.go — BridgeInfo(), startBridge(), saveBridgeConfig()
- Тесты: ping, auth, success, empty batch, secret gen, auto-port

internal/core/files/file.go

@@ -226,6 +226,32 @@ func (s *Service) ListTrashedByNode(nodeID string) ([]Record, error) {
 	return scanRecords(rows)
 }
 
+// ListAllVault returns all active (non-missing) vault-stored file records.
+func (s *Service) ListAllVault() ([]Record, error) {
+	rows, err := s.db.Query(
+		`SELECT id,node_id,filename,path,storage_mode,size,sha256,mime,
+			created_at,updated_at,last_seen_at,missing
+		 FROM files WHERE storage_mode = 'vault' AND missing != 1 ORDER BY path`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanRecords(rows)
+}
+
+// ListAllVaultWithTrashed returns ALL vault-stored file records, including missing ones.
+func (s *Service) ListAllVaultWithTrashed() ([]Record, error) {
+	rows, err := s.db.Query(
+		`SELECT id,node_id,filename,path,storage_mode,size,sha256,mime,
+			created_at,updated_at,last_seen_at,missing
+		 FROM files WHERE storage_mode = 'vault' ORDER BY path`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanRecords(rows)
+}
+
 // MarkMissing flags a file as missing.
 func (s *Service) MarkMissing(id string, missing bool) error {
 	m := 0