update local changes

.gitignore

@@ -0,0 +1,2 @@
+.env
+data/

docker-compose.yml

@@ -4,11 +4,8 @@ services:
     ports:
       - "8765:8765"
     volumes:
-      - pinvault-data:/data
+      - ./data:/data
       - /mnt/aidata:/mnt/aidata
     environment:
       - PINVAULT_MASTER_HASH=${PINVAULT_MASTER_HASH}
     restart: unless-stopped
-
-volumes:
-  pinvault-data:

static/app.js

@@ -133,10 +133,42 @@ document.getElementById("add-form").addEventListener("submit", async (e) => {
   }
 });
 
-function accessPin(id) {
+async function accessPin(id) {
   const title = document.getElementById("modal-title");
   const body = document.getElementById("modal-body");
   title.textContent = `Access PIN #${id}`;
+
+  const pins = await api("/api/pins");
+  const pin = pins.find(p => p.id === id);
+
+  if (pin && !pin.locked) {
+    body.innerHTML = `
+      <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
+        This PIN is unlocked and ready to view.
+      </p>
+      <button id="reveal-btn" class="btn btn-primary" style="width:100%">Reveal PIN</button>`;
+    document.getElementById("modal-overlay").classList.remove("hidden");
+
+    document.getElementById("reveal-btn").addEventListener("click", async () => {
+      try {
+        const result = await api(`/api/pins/${id}/access`, {
+          method: "POST",
+          body: JSON.stringify({}),
+        });
+        body.innerHTML = `
+          <div class="text-center">
+            <p class="muted" style="margin-bottom:0.3rem">Your PIN</p>
+            <div class="pin-display">${result.pin}</div>
+            <button class="btn btn-sm" onclick="copyTextDirect('${result.pin}')" style="margin-top:0.5rem">
+              Copy PIN &#x1f4cb;
+            </button>
+          </div>`;
+        loadPins();
+      } catch (err) {
+        body.innerHTML = `<p class="error-msg">${esc(err.message)}</p>`;
+      }
+    });
+  } else {
     body.innerHTML = `
       <p class="muted" style="margin-bottom:1rem;font-size:0.85rem">
         Enter a recovery code to bypass the lock:
@@ -179,6 +211,7 @@ function accessPin(id) {
       }
     });
   }
+}
 
 async function deletePin(id, label) {
   const lbl = label || `#${id}`;