refactor(js): extract TOTP module + add RFC 6238 tests (§3.1)

Fourth slice of the app.js split. Moves TOTP (base32Decode, generateTOTP,
parseOtpAuthUri) plus the TOTP-secret and custom-field AES-GCM wrappers to
js/app.totp.js. Loads before app.js (pure declarations), after app.crypto.js
(uses encryptPwd/decryptPwd). Also called by app.import.js and app.sync.js
via shared global scope.

- Byte-for-byte identical extraction; no duplicate const; syntax OK on all
  five app parts.
- NEW: js/tests/totp.test.js — 13 tests including the 5 RFC 6238 Appendix B
  reference vectors (generateTOTP reads Date.now(), so each case stubs the
  sandbox clock to the vector's fixed time), base32 decode edge cases, and
  parseOtpAuthUri. Extraction AND new coverage in one slice.
- Suite: 42 → 55 tests, all green.
- Assets regenerated (manifest now embeds all 6 ordered JS files:
  argon2 → crypto → totp → import → app → sync); also fixes the previous
  import commit's not-yet-rebuilt manifest.
- Delphi build artifacts (*.vrc, *.$manifest) gitignored.

app.js: 11936 → 10138 lines (4 modules extracted, ~1800 lines).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

delphi-backend/assets/BuildAssets.ps1

@@ -53,6 +53,7 @@ $patterns = @(
     'index.html',
     'js\argon2.js',
     'js\app.crypto.js',
+    'js\app.totp.js',
     'js\app.import.js',
     'js\app.js',
     'js\app.sync.js',

delphi-backend/assets/assets.inc

@@ -1,10 +1,12 @@
 // Auto-generated by BuildAssets.ps1 - do not edit by hand.
 const
-  EMBEDDED_ASSET_COUNT = 6;
+  EMBEDDED_ASSET_COUNT = 8;
   EMBEDDED_ASSETS: array[0..EMBEDDED_ASSET_COUNT-1] of TEmbeddedAsset = (
     (UrlPath: '/index.html'; ResName: 'INDEX_HTML'),
     (UrlPath: '/js/argon2.js'; ResName: 'JS_ARGON2_JS'),
     (UrlPath: '/js/app.crypto.js'; ResName: 'JS_APP_CRYPTO_JS'),
+    (UrlPath: '/js/app.totp.js'; ResName: 'JS_APP_TOTP_JS'),
+    (UrlPath: '/js/app.import.js'; ResName: 'JS_APP_IMPORT_JS'),
     (UrlPath: '/js/app.js'; ResName: 'JS_APP_JS'),
     (UrlPath: '/js/app.sync.js'; ResName: 'JS_APP_SYNC_JS'),
     (UrlPath: '/css/style.css'; ResName: 'CSS_STYLE_CSS')

delphi-backend/assets/assets.rc

@@ -4,6 +4,8 @@
 INDEX_HTML RCDATA "Z:\\password-manager\\index.html"
 JS_ARGON2_JS RCDATA "Z:\\password-manager\\js\\argon2.js"
 JS_APP_CRYPTO_JS RCDATA "Z:\\password-manager\\js\\app.crypto.js"
+JS_APP_TOTP_JS RCDATA "Z:\\password-manager\\js\\app.totp.js"
+JS_APP_IMPORT_JS RCDATA "Z:\\password-manager\\js\\app.import.js"
 JS_APP_JS RCDATA "Z:\\password-manager\\js\\app.js"
 JS_APP_SYNC_JS RCDATA "Z:\\password-manager\\js\\app.sync.js"
 CSS_STYLE_CSS RCDATA "Z:\\password-manager\\css\\style.css"