carlos / contra Public

Deferred from v1 (AGENTS.md, decision 7). v1 imports 1Password's 1PUX only, because that is where the first users are coming from.

Trigger to build: 1PUX import is shipped and a real user asks.

Bitwarden's export is JSON and well documented, and — like 1PUX — it must be parsed and sealed entirely in the browser. An unsealed export reaching the server would break the one rule.