feat(ui): 首次启动加密引导 + 真窗口图标 (.syso)

首次启动:
- 配置文件不存在时弹欢迎对话框：选「启用密码保护」或「稍后再说」
- 选启用直接进 setPasswordDialog，OK 时 store.SetPassword 触发首次保存
- io/fs.ErrNotExist 检测新分支
- modalCard 抽出 modalShell 内核以便 welcomeDialog 自定义 footer

真窗口图标:
- tools/gen_ico 从 PNG 生成多分辨率 .ico（7 尺寸：16~256）
- 提交 rsrc_windows.syso（rsrc 通过 goproxy.cn 生成），go build 自动链入
- tray_windows.go 改用嵌入资源 ID=1，失败 fallback IDI_APPLICATION
- README 更新完整的图标生成流程

internal/ui/assets/README.md

@@ -25,13 +25,27 @@ embedded at build time via `//go:embed` in `internal/ui/vendor_icons.go`.
 
 A 256×256 placeholder for the application window/tray icon. Gio v0.7 has
 no runtime API to set the window icon — for Windows you need to embed a
-`.ico` resource via `rsrc` or `goversioninfo` at build time:
+`.ico` resource via `rsrc` or `goversioninfo` at build time. The
+workflow is:
 
 ```
-go install github.com/akavel/rsrc@latest
-rsrc -ico app.ico -o cmd/winauth/rsrc_windows.syso
+# 1. Regenerate app_icon.png (optional — only if you change the source)
+go run ./tools/gen_icons
+
+# 2. Bake a multi-resolution app_icon.ico from the PNG
+go run ./tools/gen_ico
+
+# 3. Compile the .ico into a COFF .syso that Go auto-links
+GOPROXY=https://goproxy.cn,direct go run github.com/akavel/rsrc@latest \
+    -ico internal/ui/assets/app_icon.ico \
+    -o internal/ui/assets/rsrc_windows.syso
 ```
 
+`rsrc_windows.syso` lives next to other assets so `go build` picks it up
+without any extra build-tag wiring. The tray runtime loads the icon by
+resource id 1 (the first (and only) icon rsrc emits); if loading fails
+it falls back to `IDI_APPLICATION`.
+
 To regenerate the placeholders, run:
 
 ```