feat(cli): list/get 子命令 — 脚本集成 TOTP 获取

- winauth list: tabwriter 列出所有条目（名称/vendor/icon/hotkey）
- winauth get NAME: 输出当前 OTP，-n 不换行，--advance 允许 HOTP
- 加密配置自动 tty 隐藏密码提示（golang.org/x/term）
- --config 改为 PersistentFlag，子命令可继承
- HOTP get 默认拒绝，需 --advance 显式确认并保存配置
- CLI 不运行 GUI、不持有单实例锁

cmd/winauth/passphrase.go

@@ -0,0 +1,31 @@
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+
+	"golang.org/x/term"
+)
+
+// readPassword prompts the user for a password on the given file
+// descriptor. If the fd is a terminal the input is hidden; otherwise
+// (piped stdin) it falls back to a plain read.
+func readPassword(prompt string) ([]byte, error) {
+	fd := int(os.Stdin.Fd())
+	if term.IsTerminal(fd) {
+		fmt.Fprint(os.Stderr, prompt)
+		pw, err := term.ReadPassword(fd)
+		fmt.Fprintln(os.Stderr)
+		return pw, err
+	}
+	// Non-tty (piped): read a line without echo hiding.
+	scanner := bufio.NewScanner(os.Stdin)
+	if !scanner.Scan() {
+		if err := scanner.Err(); err != nil {
+			return nil, err
+		}
+		return nil, fmt.Errorf("no input on stdin")
+	}
+	return []byte(scanner.Text()), nil
+}