feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/authenticator/base.go

@@ -0,0 +1,84 @@
+package authenticator
+
+import (
+	"sync"
+	"time"
+
+	"git.wxccs.org/iceking2nd/winauth-go/internal/global"
+)
+
+// Authenticator is the interface implemented by every concrete OTP type.
+// It deliberately mirrors the surface of the C# Authenticator base class
+// rather than introducing a wider/cleaner Go interface, so the port can
+// stay close to the original.
+type Authenticator interface {
+	// Name returns a short identifier for logging ("google", "battlenet", ...).
+	Name() string
+
+	// CurrentCode returns the OTP that should be shown to the user right now.
+	CurrentCode() (string, error)
+
+	// SecretData returns the serialized form of the secret + parameters,
+	// matching the field stored inside the original XML config under
+	// <secretdata>.
+	SecretData() string
+
+	// SetSecretData reverses SecretData, populating the receiver.
+	SetSecretData(value string) error
+
+	// Sync re-aligns the server time offset using whatever network call the
+	// concrete authenticator supports.
+	Sync() error
+}
+
+// Base holds fields shared by every concrete authenticator. Embed it in
+// your subtype to inherit the field set and common helpers.
+type Base struct {
+	SecretKey      []byte
+	CodeDigits     int
+	HMACType       HMACType
+	Period         int
+	ServerTimeDiff int64 // ms
+	LastServerTime int64 // ms (Unix-millis here, not .NET ticks)
+
+	mu sync.Mutex
+}
+
+// NewBase returns a Base seeded with the project-wide defaults.
+func NewBase() Base {
+	return Base{
+		CodeDigits: DefaultCodeDigits,
+		HMACType:   HMACSHA1,
+		Period:     DefaultPeriod,
+	}
+}
+
+// NowMillis is the milliseconds since the Unix epoch, equivalent to the
+// CurrentTime helper in the original C#.
+func NowMillis() int64 { return time.Now().UnixMilli() }
+
+// ServerTime returns the server's notion of "now" in milliseconds.
+func (b *Base) ServerTime() int64 { return NowMillis() + b.ServerTimeDiff }
+
+// CodeInterval returns the TOTP step number for the current server time.
+func (b *Base) CodeInterval() uint64 {
+	if b.Period <= 0 {
+		b.Period = DefaultPeriod
+	}
+	return uint64(b.ServerTime() / int64(b.Period*1000))
+}
+
+// CalculateTOTP runs the TOTP algorithm using the receiver's fields.
+func (b *Base) CalculateTOTP() string {
+	const fn = "internal.authenticator.Base.CalculateTOTP"
+	digits := b.CodeDigits
+	if digits == 0 {
+		digits = DefaultCodeDigits
+	}
+	code := hotpCode(b.SecretKey, b.CodeInterval(), digits, b.HMACType)
+	global.Log.WithField("func", fn).
+		WithField("interval", b.CodeInterval()).
+		WithField("digits", digits).
+		Trace("computed TOTP")
+	return code
+}