- Add 12s timeout to restoreSession() — client.init() could hang indefinitely if token expired or server unreachable, leaving user on spinner forever. Now clears stale credentials and shows login. - Sync persistence startup wrapped in try-catch — non-fatal - .htaccess blocks .git directory (was returning 200 to scanners) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>