feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

icon-key.svg

@@ -0,0 +1,49 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256">
+  <defs>
+    <linearGradient id="keyBow" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0" stop-color="#22d3ee"/>
+      <stop offset="1" stop-color="#0891b2"/>
+    </linearGradient>
+    <linearGradient id="keyStem" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#06b6d4"/>
+      <stop offset="1" stop-color="#0e7490"/>
+    </linearGradient>
+    <radialGradient id="bowHole" cx="0.5" cy="0.5" r="0.5">
+      <stop offset="0"   stop-color="#a78bfa"/>
+      <stop offset="0.7" stop-color="#7c3aed"/>
+      <stop offset="1"   stop-color="#5b21b6"/>
+    </radialGradient>
+    <filter id="dropK" x="-15%" y="-15%" width="130%" height="130%">
+      <feDropShadow dx="0" dy="6" stdDeviation="8" flood-opacity="0.4"/>
+    </filter>
+  </defs>
+
+  <g filter="url(#dropK)">
+    <!-- Key bow (hexagonal head) -->
+    <path d="M 128 24
+             L 196 64
+             V 144
+             L 128 184
+             L 60  144
+             V 64 Z"
+          fill="url(#keyBow)"
+          stroke="#0e7490" stroke-width="3" stroke-linejoin="round"/>
+
+    <!-- Stem -->
+    <rect x="114" y="170" width="28" height="60" rx="6"
+          fill="url(#keyStem)"/>
+
+    <!-- Tooth 1 -->
+    <rect x="142" y="190" width="22" height="12" rx="3"
+          fill="url(#keyStem)"/>
+
+    <!-- Tooth 2 (smaller) -->
+    <rect x="142" y="212" width="14" height="10" rx="3"
+          fill="url(#keyStem)"/>
+  </g>
+
+  <!-- Center hole in bow (with accent glow) -->
+  <circle cx="128" cy="104" r="26" fill="url(#bowHole)"/>
+  <circle cx="128" cy="104" r="14" fill="#0f172a"/>
+  <circle cx="128" cy="104" r="6"  fill="#a78bfa" opacity="0.7"/>
+</svg>