SECURITY FIX: Move encryption key from query parameters to URL fragment

[link0ln]

CRITICAL: This fixes a major security vulnerability where encryption keys were exposed to the server via query parameters.

Problem:

• Before: https://inigma.idone.su/view?view=XXX&key=SECRET_KEY
• Encryption key was sent to server in HTTP GET request
• Keys were logged in nginx access logs
• Keys were visible to server admins, monitoring systems, and proxy servers
• This completely broke the end-to-end encryption promise

Solution:

• After: https://inigma.idone.su/view?view=XXX#key=SECRET_KEY
• Encryption key is now in URL fragment (hash)
• Fragments are NEVER sent to the server per RFC 3986
• Only the browser sees the encryption key
• True end-to-end encryption is now achieved

Changes:

1. main-app.js:160 - Changed '&key=' to '#key=' in URL generation
2. view-app.js:20-28 - Read key from window.location.hash instead of query
3. view-app.js:26-28 - Immediately clean URL to remove key from address bar

Impact:

• New links generated will have true E2E encryption
• Old links (with &key=) will stop working - this is intentional
• Existing logs may contain encryption keys - recommend log rotation

Security Level: CRITICAL
Breaking Change: YES (old links incompatible)
Ref: RFC 3986 - URI Generic Syntax, Section 3.5 (Fragment)