feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

delphi-backend/Source/PM.ProcessLockdown.pas

@@ -0,0 +1,116 @@
+unit PM.ProcessLockdown;
+
+interface
+
+uses
+  Winapi.Windows;
+
+function GetPidOfTcpConnection(ALocalPort, ARemotePort: Word): DWORD;
+function IsDescendantOfCurrentProcess(APid: DWORD): Boolean;
+
+implementation
+
+uses
+  System.SysUtils, System.Generics.Collections, Winapi.WinSock,
+  Winapi.TlHelp32;
+
+const
+  IPHLPAPI                          = 'iphlpapi.dll';
+  AF_INET_LOCAL                     = 2;
+  TCP_TABLE_OWNER_PID_CONNECTIONS   = 4;
+  NO_ERROR                          = 0;
+
+type
+  MIB_TCPROW_OWNER_PID = record
+    dwState:      DWORD;
+    dwLocalAddr:  DWORD;
+    dwLocalPort:  DWORD;
+    dwRemoteAddr: DWORD;
+    dwRemotePort: DWORD;
+    dwOwningPid:  DWORD;
+  end;
+
+  MIB_TCPTABLE_OWNER_PID = record
+    dwNumEntries: DWORD;
+    table: array[0..0] of MIB_TCPROW_OWNER_PID;
+  end;
+  PMIB_TCPTABLE_OWNER_PID = ^MIB_TCPTABLE_OWNER_PID;
+
+function GetExtendedTcpTable(pTcpTable: Pointer; pdwSize: PDWORD;
+  bOrder: BOOL; ulAf: ULONG; TableClass: DWORD; Reserved: ULONG): DWORD;
+  stdcall; external IPHLPAPI;
+
+function GetPidOfTcpConnection(ALocalPort, ARemotePort: Word): DWORD;
+var
+  Size: DWORD;
+  Buffer: PMIB_TCPTABLE_OWNER_PID;
+  i: Integer;
+  Row: ^MIB_TCPROW_OWNER_PID;
+  WantedLocal, WantedRemote: Word;
+begin
+  Result := 0;
+  Size := 0;
+  GetExtendedTcpTable(nil, @Size, False, AF_INET_LOCAL,
+    TCP_TABLE_OWNER_PID_CONNECTIONS, 0);
+  if Size = 0 then Exit;
+
+  GetMem(Buffer, Size);
+  try
+    if GetExtendedTcpTable(Buffer, @Size, False, AF_INET_LOCAL,
+         TCP_TABLE_OWNER_PID_CONNECTIONS, 0) <> NO_ERROR then Exit;
+
+    WantedLocal  := ntohs(ALocalPort);
+    WantedRemote := ntohs(ARemotePort);
+    Row := @Buffer.table[0];
+    for i := 0 to Buffer.dwNumEntries - 1 do
+    begin
+      if (Word(Row.dwLocalPort)  = WantedLocal) and
+         (Word(Row.dwRemotePort) = WantedRemote) then
+        Exit(Row.dwOwningPid);
+      Inc(Row);
+    end;
+  finally
+    FreeMem(Buffer);
+  end;
+end;
+
+function IsDescendantOfCurrentProcess(APid: DWORD): Boolean;
+const
+  MaxDepth = 32;
+var
+  Snap: THandle;
+  Entry: TProcessEntry32W;
+  ParentMap: TDictionary<DWORD, DWORD>;
+  Current, RootPid: DWORD;
+  Depth: Integer;
+begin
+  Result := False;
+  if APid = 0 then Exit;
+  RootPid := GetCurrentProcessId;
+  if APid = RootPid then Exit(True);
+
+  Snap := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if Snap = INVALID_HANDLE_VALUE then Exit;
+
+  ParentMap := TDictionary<DWORD, DWORD>.Create;
+  try
+    Entry.dwSize := SizeOf(Entry);
+    if Process32FirstW(Snap, Entry) then
+    repeat
+      ParentMap.AddOrSetValue(Entry.th32ProcessID, Entry.th32ParentProcessID);
+    until not Process32NextW(Snap, Entry);
+
+    Current := APid;
+    for Depth := 0 to MaxDepth do
+    begin
+      if Current = RootPid then Exit(True);
+      if not ParentMap.TryGetValue(Current, Current) then Exit;
+      if (Current = 0) or (Current = 4) then Exit;
+    end;
+  finally
+    ParentMap.Free;
+    CloseHandle(Snap);
+  end;
+end;
+
+end.