Normalize vault storage root on open and create

internal/vault/kdbx.go

@@ -26,6 +26,7 @@ var ErrInvalidMasterKey = errors.New("invalid master key")
 const (
 	templatesRoot     = "Templates"
 	recycleBinRoot    = "Recycle Bin"
+	keepassRoot       = "keepass"
 	keepassGOIDField  = "KeePassGO-ID"
 	remoteProfilesKey = "keepassgo.remoteProfiles"
 )
@@ -502,6 +503,10 @@ func compareGroupNames(a, b string) int {
 		return -1
 	case b == "Root":
 		return 1
+	case a == keepassRoot:
+		return -1
+	case b == keepassRoot:
+		return 1
 	case a == templatesRoot:
 		return -1
 	case b == templatesRoot:

internal/vault/kdbx_test.go

@@ -755,6 +755,57 @@ func TestKDBXReopenCyclesPreserveStableIDsAndCrossFeatureState(t *testing.T) {
 	}
 }
 
+func TestKDBXKeepassRootEntriesPreserveAttachmentsWithTemplates(t *testing.T) {
+	t.Parallel()
+
+	model := Model{
+		Entries: []Entry{
+			{
+				ID:       "entry-1",
+				Title:    "Vault Console",
+				Username: "dannyocean",
+				Password: "bellagio-pass-2",
+				URL:      "https://vault.crew.example.invalid",
+				Path:     []string{"keepass", "Internet"},
+				Attachments: map[string][]byte{
+					"token.txt": []byte("secret attachment contents"),
+				},
+			},
+		},
+		Templates: []Entry{
+			{
+				ID:       "tpl-1",
+				Title:    "Website Login",
+				Username: "template-user",
+				Password: "template-password",
+				Path:     []string{"Templates", "Web"},
+			},
+		},
+		Groups: [][]string{
+			{"keepass", "Internet"},
+			{"Templates", "Web"},
+		},
+	}
+
+	var encoded bytes.Buffer
+	if err := SaveKDBX(&encoded, model, "correct horse battery staple"); err != nil {
+		t.Fatalf("SaveKDBX() error = %v", err)
+	}
+
+	loaded, err := LoadKDBX(bytes.NewReader(encoded.Bytes()), "correct horse battery staple")
+	if err != nil {
+		t.Fatalf("LoadKDBX() error = %v", err)
+	}
+
+	got := loaded.EntriesInPath([]string{"keepass", "Internet"})
+	if len(got) != 1 {
+		t.Fatalf("len(EntriesInPath()) = %d, want 1", len(got))
+	}
+	if string(got[0].Attachments["token.txt"]) != "secret attachment contents" {
+		t.Fatalf("attachment contents = %q, want %q", string(got[0].Attachments["token.txt"]), "secret attachment contents")
+	}
+}
+
 func mustGroup(name string, children ...any) gokeepasslib.Group {
 	group := gokeepasslib.NewGroup()
 	group.Name = name