Phase 3: Session recording/playback and encrypted profile export/import

Session Recording & Playback:
- Add recording package with asciicast v2 format writer and reader
- Recorder captures terminal I/O with timestamps from SSH and Telnet sessions
- Input and output events recorded via hooks in session manager callbacks
- Recording store manages .cast files in ~/Library/Application Support/NexusTerminal/recordings
- Recording browser modal lists all saved recordings with metadata
- Full playback viewer with embedded xterm.js terminal, progress scrubber,
  play/pause/restart controls, and 0.5x-10x speed adjustment
- Recording indicator (pulsing red dot) shown on active tab during capture
- Keyboard shortcut Cmd+Shift+R to toggle recording on active session
- Tests for recording, store listing, deletion, and double-close safety

Encrypted Profile Export/Import:
- Add exportimport package with AES-256-GCM encryption (Argon2id key derivation)
- File format: version byte + 32-byte salt + 12-byte nonce + ciphertext
- Same Argon2id parameters as vault (128 MiB, 3 iterations, 4 threads)
- Export modal with profile selection checkboxes and password entry
- Import modal with password entry and conflict strategy (skip/overwrite/duplicate)
- Native save/open file dialogs for .nexus files
- Tests for round-trip encryption, wrong password rejection, corrupt files
- Replaced placeholder import/export with full encrypted implementation

UI:
- Added export and recordings buttons to sidebar footer
- Recording and playback CSS with charcoal design tokens
- Wired RecordingManager and ExportImportUI into app.js

internal/exportimport/exportimport_test.go

@@ -0,0 +1,131 @@
+package exportimport
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/copilot-ssh-client/app/internal/models"
+)
+
+func TestEncryptDecryptRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test-export.nexus")
+
+	profiles := []models.Profile{
+		{
+			ID:          "test-1",
+			DisplayName: "Test Server",
+			Protocol:    models.ProtocolSSH,
+			Host:        "example.com",
+			Port:        22,
+			Username:    "admin",
+		},
+		{
+			ID:          "test-2",
+			DisplayName: "Dev Box",
+			Protocol:    models.ProtocolSSH,
+			Host:        "dev.example.com",
+			Port:        2222,
+			Username:    "developer",
+		},
+	}
+
+	password := "strong-test-password-2024!"
+
+	// Encrypt and export.
+	if err := EncryptAndExport(profiles, password, path); err != nil {
+		t.Fatalf("EncryptAndExport failed: %v", err)
+	}
+
+	// Verify file exists and has content.
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("exported file not found: %v", err)
+	}
+	if info.Size() == 0 {
+		t.Fatal("exported file is empty")
+	}
+
+	// Decrypt and import.
+	imported, err := DecryptAndImport(path, password)
+	if err != nil {
+		t.Fatalf("DecryptAndImport failed: %v", err)
+	}
+
+	if len(imported) != len(profiles) {
+		t.Fatalf("expected %d profiles, got %d", len(profiles), len(imported))
+	}
+
+	for i, p := range imported {
+		if p.ID != profiles[i].ID {
+			t.Errorf("profile %d: expected ID %q, got %q", i, profiles[i].ID, p.ID)
+		}
+		if p.DisplayName != profiles[i].DisplayName {
+			t.Errorf("profile %d: expected DisplayName %q, got %q", i, profiles[i].DisplayName, p.DisplayName)
+		}
+		if p.Host != profiles[i].Host {
+			t.Errorf("profile %d: expected Host %q, got %q", i, profiles[i].Host, p.Host)
+		}
+	}
+}
+
+func TestDecryptWrongPassword(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test-export.nexus")
+
+	profiles := []models.Profile{
+		{
+			ID:          "test-1",
+			DisplayName: "Test",
+			Protocol:    models.ProtocolSSH,
+			Host:        "example.com",
+			Port:        22,
+		},
+	}
+
+	if err := EncryptAndExport(profiles, "correct-password", path); err != nil {
+		t.Fatalf("EncryptAndExport failed: %v", err)
+	}
+
+	_, err := DecryptAndImport(path, "wrong-password")
+	if err == nil {
+		t.Fatal("expected error with wrong password, got nil")
+	}
+}
+
+func TestEncryptEmptyProfiles(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.nexus")
+
+	err := EncryptAndExport(nil, "password", path)
+	if err == nil {
+		t.Fatal("expected error for empty profiles, got nil")
+	}
+}
+
+func TestEncryptEmptyPassword(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "test.nexus")
+
+	profiles := []models.Profile{{ID: "1"}}
+	err := EncryptAndExport(profiles, "", path)
+	if err == nil {
+		t.Fatal("expected error for empty password, got nil")
+	}
+}
+
+func TestDecryptCorruptFile(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "corrupt.nexus")
+
+	// Write garbage data.
+	if err := os.WriteFile(path, []byte("corrupt"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err := DecryptAndImport(path, "password")
+	if err == nil {
+		t.Fatal("expected error for corrupt file, got nil")
+	}
+}