feat: hide recap creation behind five goldfish logo taps

Replace the visible create button with a secret tap gesture that still
opens the PIN-protected recap flow.

Co-authored-by: Cursor <cursoragent@cursor.com>

public/app.js

@@ -130,15 +130,43 @@ function wirePinForm() {
   });
 }
 
-function wireCreate() {
-  document.getElementById("newRecapBtn").addEventListener("click", async () => {
-    try {
-      await waitForPinLogin();
-      openCreateModal();
-    } catch {
-      /* cancelled */
+const GOLDFISH_TAPS = 5;
+const GOLDFISH_RESET_MS = 2000;
+
+async function openCreateFlow() {
+  try {
+    await waitForPinLogin();
+    openCreateModal();
+  } catch {
+    /* cancelled */
+  }
+}
+
+function wireGoldfishSecret() {
+  const logo = document.getElementById("goldfishLogo");
+  let taps = 0;
+  let resetTimer = null;
+
+  logo.addEventListener("click", () => {
+    taps += 1;
+    logo.classList.add("logoWiggle");
+    window.setTimeout(() => logo.classList.remove("logoWiggle"), 300);
+
+    if (resetTimer) window.clearTimeout(resetTimer);
+    resetTimer = window.setTimeout(() => {
+      taps = 0;
+    }, GOLDFISH_RESET_MS);
+
+    if (taps >= GOLDFISH_TAPS) {
+      taps = 0;
+      if (resetTimer) window.clearTimeout(resetTimer);
+      openCreateFlow();
     }
   });
+}
+
+function wireCreate() {
+  wireGoldfishSecret();
   document.getElementById("createCancel").addEventListener("click", () => createModal.close());
   document.getElementById("createForm").addEventListener("submit", async (e) => {
     e.preventDefault();