feat: MFA tools, single-instance, tray polish, prefs persistence

Session highlights:

- feat(prefs): DPAPI-backed key/value store (PM.UserPrefs) — fixes
  rememberedUsername being lost across reboots due to the random
  ephemeral HTTP port changing the localStorage origin every launch.
  Bridge cmd://prefs/{get,set} round-trips through Delphi.

- feat(tray): icon visible from startup (NIM_ADD at constructor, not
  at first minimize). Tray context menu themed via uxtheme!135
  SetPreferredAppMode so it follows the app's dark/light setting.

- feat(single-instance): named mutex + RegisterWindowMessage broadcast.
  Second launch posts WM_PMSHOW to HWND_BROADCAST and exits; the
  running bridge restores the window from tray. Mutex lives in Local\
  namespace so distinct Windows users can still each run one.

- feat(mfa): Authenticator sidebar view (live TOTP codes for every
  entry with a secret) + standalone TOTP generator modal (paste
  base32 / otpauth:// URI, or generate a random 20-byte secret).

- feat(sidebar): Folders / Tags / Tools sections collapsible with
  chevron toggle. Badge counts stay visible when collapsed. State
  persisted in settings_json (synced across devices).

- feat(autofill): hotkey when vault is locked now restores the app
  and focuses the master password input instead of no-op'ing
  silently. Cleaner UX for the common "I hit Ctrl+Shift+L but the
  vault was locked" path.

- feat(quick-unlock): when enabled, skip lockVault on Windows lock /
  sleep. Rationale: the DPAPI blob already gates access via the
  Windows account, so re-locking on top of the OS lock is redundant.
  Idle auto-lock still fires (separate opt-in).

- fix(quick-unlock): re-sync state.quickUnlockEnabled from DPAPI
  source-of-truth at boot, instead of trusting (now-volatile)
  localStorage.

- docs: CLAUDE.md updated with all new modules, bridge commands,
  and the port-ephemeral pitfall.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

icon-vault.svg

@@ -0,0 +1,49 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 256 256">
+  <defs>
+    <radialGradient id="bodyV" cx="0.5" cy="0.35" r="0.7">
+      <stop offset="0" stop-color="#475569"/>
+      <stop offset="1" stop-color="#1e293b"/>
+    </radialGradient>
+    <radialGradient id="dial" cx="0.5" cy="0.4" r="0.6">
+      <stop offset="0" stop-color="#f1f5f9"/>
+      <stop offset="1" stop-color="#94a3b8"/>
+    </radialGradient>
+    <linearGradient id="accentV" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0" stop-color="#22d3ee"/>
+      <stop offset="1" stop-color="#06b6d4"/>
+    </linearGradient>
+    <filter id="dropV" x="-10%" y="-10%" width="120%" height="120%">
+      <feDropShadow dx="0" dy="4" stdDeviation="6" flood-opacity="0.35"/>
+    </filter>
+  </defs>
+
+  <!-- Vault body — circle with radial gradient, no container -->
+  <g filter="url(#dropV)">
+    <circle cx="128" cy="128" r="120" fill="url(#bodyV)"/>
+    <circle cx="128" cy="128" r="120" fill="none"
+            stroke="#0f172a" stroke-width="2"/>
+  </g>
+
+  <!-- Inner dial bezel -->
+  <circle cx="128" cy="128" r="88" fill="#334155"/>
+  <circle cx="128" cy="128" r="80" fill="url(#dial)"/>
+
+  <!-- Tick marks -->
+  <g stroke="#475569" stroke-width="3" stroke-linecap="round">
+    <line x1="128" y1="54"  x2="128" y2="64"/>
+    <line x1="128" y1="192" x2="128" y2="202"/>
+    <line x1="54"  y1="128" x2="64"  y2="128"/>
+    <line x1="192" y1="128" x2="202" y2="128"/>
+    <line x1="76"  y1="76"  x2="83"  y2="83"/>
+    <line x1="180" y1="76"  x2="173" y2="83"/>
+    <line x1="76"  y1="180" x2="83"  y2="173"/>
+    <line x1="180" y1="180" x2="173" y2="173"/>
+  </g>
+
+  <!-- Center hub -->
+  <circle cx="128" cy="128" r="28" fill="url(#accentV)"/>
+  <circle cx="128" cy="128" r="10" fill="#0f172a"/>
+
+  <!-- Dial pointer -->
+  <rect x="124" y="60" width="8" height="34" rx="3" fill="url(#accentV)"/>
+</svg>