feat(security): "Lock vault when Windows locks or sleeps" toggle (default ON)

Explicit opt-out for users without Quick Unlock who don't want to retype the
master password after every sleep. Default ON = exact historical behavior
(lock on WTS lock/suspend, with the documented Quick Unlock exemption —
DPAPI already gates access via the Windows account). Synced setting,
Settings > Security.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

index.html

@@ -566,6 +566,19 @@
                         <option value="60">60</option>
                     </select>
                 </div>
+                <div class="setting-row">
+                    <span>
+                        Lock vault when Windows locks or sleeps
+                        <small class="setting-hint">
+                            With Quick Unlock enabled the vault stays unlocked
+                            anyway — Windows sign-in already gates access.
+                        </small>
+                    </span>
+                    <label class="toggle">
+                        <input type="checkbox" id="settingLockOnSystemLock">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
                 <div class="setting-row">
                     <span>Ask before moving to trash</span>
                     <label class="toggle">