feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Handlers/PM.Handler.Auth.pas

@@ -19,9 +19,9 @@ interface
 implementation
 
 uses
-  System.SysUtils, System.JSON, System.Classes,
-  FireDAC.Comp.Client,
-  IdCustomHTTPServer,Data.DB,
+  System.SysUtils, System.JSON, System.Classes, System.Generics.Collections,
+  Data.DB, FireDAC.Comp.Client, FireDAC.Stan.Param,
+  IdCustomHTTPServer,
   PM.Router, PM.JSON, PM.Database, PM.Crypto,
   PM.Session, PM.RateLimit, PM.Audit;
 
@@ -961,8 +961,21 @@ begin
       DB.Unlock;
     end;
 
-    // Step 5: invalidate every other session for this user. The CURRENT
-    // session token is still valid — caller stays logged in.
+    DB.Lock;
+    try
+      LQ := TFDQuery.Create(nil);
+      try
+        LQ.Connection := DB.Connection;
+        LQ.SQL.Text := 'DELETE FROM recovery_keys WHERE user_id = :uid';
+        LQ.ParamByName('uid').AsInteger := LUserId;
+        LQ.ExecSQL;
+      finally
+        LQ.Free;
+      end;
+    finally
+      DB.Unlock;
+    end;
+
     DeleteAllUserSessions(LUserId);
   finally
     LBody.Free;