feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Source/PM.Database.pas

@@ -231,6 +231,10 @@ begin
   // UI V2: tags stored as comma-separated TEXT (e.g. "work,important,2fa").
   // Simple format, search via LIKE %tag%. Frontend handles parsing/joining.
   AddColumnIfMissing('vault_entries', 'tags',              'TEXT DEFAULT ''''');
+  // Optional human-friendly display name. When empty, the UI falls back
+  // to `site`. Lets the user store the raw URL/host (used for autofill
+  // domain matching) while showing something nicer on cards/slideovers.
+  AddColumnIfMissing('vault_entries', 'title',             'TEXT DEFAULT ''''');
   // TOTP (2FA) — RFC 6238. Secret + IV are AES-GCM ciphertext / IV pair
   // encrypted client-side with the user's master-derived key, exactly like
   // encrypted_password. The server treats them as opaque blobs and never
@@ -244,6 +248,12 @@ begin
   // (600 000 as of 2026). Login flow transparently re-hashes legacy users
   // and re-encrypts their entries on the client side.
   AddColumnIfMissing('users',         'kdf_iterations',    'INTEGER DEFAULT 100000');
+  AddColumnIfMissing('recovery_keys', 'remaining_uses',    'INTEGER DEFAULT 5');
+  // Server-side preferences blob (JSON). Synced across devices on login,
+  // saved on every change from the JS settings panel. Device-specific
+  // toggles (quick-unlock DPAPI, Win32 autofill hotkey) intentionally stay
+  // in localStorage and are NOT included here.
+  AddColumnIfMissing('users',         'settings_json',     'TEXT DEFAULT ''{}''');
   AddColumnIfMissing('sessions',      'csrf_token',        'TEXT');
 end;