feat(sync): encrypt snippet sync snapshots

docs/content/docs/cloud-sync.cn.mdx

@@ -54,7 +54,11 @@ DBX 可以把连接配置、界面设置和保存的 SQL 组成一个快照，
   <Step>### 创建 Gist 将 **代码片段 ID** 留空，点击 **上传**。DBX 会创建私有 Gist，并自动保存返回的 ID。</Step>
 </Steps>
 
-DBX 会在 Gist 中保存一个 `dbx-sync.json` 文件。后续上传会更新同一个 Gist，GitHub 会保留 Gist 的修改历史。
+DBX 会在 Gist 中保存一个经过**代码片段加密密码**加密的 `dbx-sync.json` 文件。该密码保护完整快照，片段链接本身不会暴露连接信息、SQL 或设置；历史明文片段仍可下载一次以便迁移。
+
+<Callout type="warn">
+旧版本创建的明文片段不能安全地原地迁移：更新同一个 Gist 不会删除历史修订。请使用 **迁移旧版代码片段** 操作。DBX 会先将已有的远端快照加密写入新片段并保存新 ID，然后重新读取旧片段后才删除它；如果另一台设备已更新旧内容，则停止自动删除并提示手动清理。若旧快照包含已加密的敏感信息，请输入其原敏感信息同步密码以完成删除前验证。请轮换旧片段中可能已经暴露的凭据。
+</Callout>
 
 ### 在另一台设备恢复
 
@@ -84,19 +88,21 @@ DBX 会在 Gist 中保存一个 `dbx-sync.json` 文件。后续上传会更新
 
 Gitee 代码片段中同样使用 `dbx-sync.json` 文件。
 
-## 同步敏感信息
+## 同步密码与敏感信息
+
+GitHub Gist 和 Gitee 代码片段始终使用**代码片段加密密码**加密整个快照。该密码不会上传或保存，也无法找回；它与可选敏感信息的同步密码相互独立。
 
 默认快照不会包含数据库密码等密钥。如果需要在新设备直接恢复密码：
 
-1. 开启 **同步加密后的敏感信息**。
-2. 输入单独的 **同步密码**。
+1. 开启 **上传时包含加密敏感信息**。
+2. 输入单独的 **敏感信息同步密码**。
 3. 上传快照。
-4. 在另一台设备下载时输入相同的同步密码。
+4. 在另一台设备开启 **下载时恢复加密敏感信息** 并输入同一密码；保持关闭即可保留本地密码。
 
-敏感信息使用 **Argon2id** 派生密钥，并使用 **AES-256-GCM** 加密。访问令牌只会使用设备密钥加密保存在本机，永远不会写入 `dbx-sync.json`。
+同步密码使用 **Argon2id** 派生密钥，并使用 **AES-256-GCM** 加密。访问令牌只会使用设备密钥加密保存在本机，永远不会写入 `dbx-sync.json`。
 
 <Callout type="warn">
-同步密码无法找回。丢失同步密码后，仍可恢复普通连接信息和 SQL，但无法解密远端敏感信息。
+两种密码都无法找回。GitHub/Gitee 的加密代码片段没有代码片段加密密码就无法恢复；WebDAV 中不含加密敏感信息的快照仍可不使用同步密码恢复。
 </Callout>
 
 ## WebDAV

docs/content/docs/cloud-sync.mdx

@@ -54,7 +54,11 @@ A classic token also works, but grant only the `gist` scope.
   <Step>### Create the Gist Leave **Snippet ID** empty and select **Upload**. DBX creates a private Gist and stores the returned ID.</Step>
 </Steps>
 
-DBX stores the snapshot as `dbx-sync.json`. Later uploads update the same Gist, and GitHub keeps its revision history.
+DBX stores an encrypted `dbx-sync.json` file in the Gist. The snippet encryption password protects the complete snapshot, so the URL does not expose connection details, SQL, or settings. Existing plain-text snippets can still be downloaded once for migration.
+
+<Callout type="warn">
+Plain-text snippets created by older versions cannot be safely migrated in place: updating the same Gist does not remove its revision history. Use **Migrate legacy snippet** instead. DBX encrypts the existing remote snapshot into a new snippet first, stores the new ID locally, and then rereads the old snippet before deleting it. If another device changed the old content, DBX stops automatic cleanup and tells you which old snippet must be deleted manually. If the old snapshot contains encrypted credentials, enter its original credentials password so DBX can verify them before cleanup. Rotate any credentials the old snippet may have exposed.
+</Callout>
 
 ### Restore on Another Device
 
@@ -84,19 +88,21 @@ DBX stores the snapshot as `dbx-sync.json`. Later uploads update the same Gist,
 
 Gitee snippets also use a `dbx-sync.json` file.
 
-## Synchronizing Secrets
+## Sync Password and Secrets
+
+GitHub Gist and Gitee snippets always encrypt the entire snapshot with a **snippet encryption password**. The password is never uploaded or saved and cannot be recovered. This password is independent from the password that encrypts optional synced credentials.
 
 Snapshots exclude credentials by default. To restore passwords on another device:
 
-1. Enable **Synchronize encrypted secrets**.
-2. Enter a separate **sync passphrase**.
+1. Enable **Include encrypted credentials when uploading**.
+2. Enter a separate **sync password** for credentials.
 3. Upload the snapshot.
-4. Enter the same passphrase when downloading on another device.
+4. On another device, enable **Restore encrypted credentials when downloading** and enter the same credentials password. Leave it off to keep local passwords unchanged.
 
-DBX derives the encryption key with **Argon2id** and encrypts secrets using **AES-256-GCM**. Provider access tokens are encrypted with a device-local key and are never written to `dbx-sync.json`.
+DBX derives the encryption key with **Argon2id** and uses **AES-256-GCM** encryption. Provider access tokens are encrypted with a device-local key and are never written to `dbx-sync.json`.
 
 <Callout type="warn">
-The sync passphrase cannot be recovered. Without it, DBX can still restore non-secret connection settings and saved SQL, but not the encrypted secrets.
+Neither password can be recovered. An encrypted GitHub/Gitee snippet cannot be restored without its snippet encryption password. For WebDAV, a snapshot without encrypted secrets can still be restored without a passphrase.
 </Callout>
 
 ## WebDAV