feat(sync): encrypt snippet sync snapshots

docs/content/docs/cloud-sync.mdx

@@ -54,7 +54,11 @@ A classic token also works, but grant only the `gist` scope.
   <Step>### Create the Gist Leave **Snippet ID** empty and select **Upload**. DBX creates a private Gist and stores the returned ID.</Step>
 </Steps>
 
-DBX stores the snapshot as `dbx-sync.json`. Later uploads update the same Gist, and GitHub keeps its revision history.
+DBX stores an encrypted `dbx-sync.json` file in the Gist. The snippet encryption password protects the complete snapshot, so the URL does not expose connection details, SQL, or settings. Existing plain-text snippets can still be downloaded once for migration.
+
+<Callout type="warn">
+Plain-text snippets created by older versions cannot be safely migrated in place: updating the same Gist does not remove its revision history. Use **Migrate legacy snippet** instead. DBX encrypts the existing remote snapshot into a new snippet first, stores the new ID locally, and then rereads the old snippet before deleting it. If another device changed the old content, DBX stops automatic cleanup and tells you which old snippet must be deleted manually. If the old snapshot contains encrypted credentials, enter its original credentials password so DBX can verify them before cleanup. Rotate any credentials the old snippet may have exposed.
+</Callout>
 
 ### Restore on Another Device
 
@@ -84,19 +88,21 @@ DBX stores the snapshot as `dbx-sync.json`. Later uploads update the same Gist,
 
 Gitee snippets also use a `dbx-sync.json` file.
 
-## Synchronizing Secrets
+## Sync Password and Secrets
+
+GitHub Gist and Gitee snippets always encrypt the entire snapshot with a **snippet encryption password**. The password is never uploaded or saved and cannot be recovered. This password is independent from the password that encrypts optional synced credentials.
 
 Snapshots exclude credentials by default. To restore passwords on another device:
 
-1. Enable **Synchronize encrypted secrets**.
-2. Enter a separate **sync passphrase**.
+1. Enable **Include encrypted credentials when uploading**.
+2. Enter a separate **sync password** for credentials.
 3. Upload the snapshot.
-4. Enter the same passphrase when downloading on another device.
+4. On another device, enable **Restore encrypted credentials when downloading** and enter the same credentials password. Leave it off to keep local passwords unchanged.
 
-DBX derives the encryption key with **Argon2id** and encrypts secrets using **AES-256-GCM**. Provider access tokens are encrypted with a device-local key and are never written to `dbx-sync.json`.
+DBX derives the encryption key with **Argon2id** and uses **AES-256-GCM** encryption. Provider access tokens are encrypted with a device-local key and are never written to `dbx-sync.json`.
 
 <Callout type="warn">
-The sync passphrase cannot be recovered. Without it, DBX can still restore non-secret connection settings and saved SQL, but not the encrypted secrets.
+Neither password can be recovered. An encrypted GitHub/Gitee snippet cannot be restored without its snippet encryption password. For WebDAV, a snapshot without encrypted secrets can still be restored without a passphrase.
 </Callout>
 
 ## WebDAV