feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/authenticator/google.go

@@ -0,0 +1,118 @@
+package authenticator
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"git.wxccs.org/iceking2nd/winauth-go/internal/global"
+	"git.wxccs.org/iceking2nd/winauth-go/internal/httpc"
+)
+
+// GoogleAuthenticator implements the time-sync flavor of TOTP that Google,
+// Microsoft and Okta all share. The only difference between vendors in the
+// original C# port is the URL used to learn the server clock.
+type GoogleAuthenticator struct {
+	Base
+	timeSyncURL string
+}
+
+// NewGoogleAuthenticator returns a Google-flavored TOTP authenticator.
+func NewGoogleAuthenticator() *GoogleAuthenticator {
+	return newTOTP("https://www.google.com")
+}
+
+// NewMicrosoftAuthenticator is an alias kept for parity with the original
+// C# class hierarchy.
+func NewMicrosoftAuthenticator() *GoogleAuthenticator {
+	return newTOTP("https://www.microsoft.com")
+}
+
+// NewOktaVerifyAuthenticator returns a TOTP that syncs against okta.com.
+func NewOktaVerifyAuthenticator() *GoogleAuthenticator {
+	return newTOTP("https://www.okta.com")
+}
+
+func newTOTP(syncURL string) *GoogleAuthenticator {
+	g := &GoogleAuthenticator{Base: NewBase(), timeSyncURL: syncURL}
+	return g
+}
+
+// Name returns a short identifier used in logs.
+func (g *GoogleAuthenticator) Name() string {
+	switch g.timeSyncURL {
+	case "https://www.microsoft.com":
+		return "microsoft"
+	case "https://www.okta.com":
+		return "okta"
+	default:
+		return "google"
+	}
+}
+
+// Enroll loads a base32-encoded shared secret and then performs an initial
+// clock sync against the vendor's HTTP endpoint.
+func (g *GoogleAuthenticator) Enroll(b32 string) error {
+	const fn = "internal.authenticator.GoogleAuthenticator.Enroll"
+	raw, err := Base32Decode(b32)
+	if err != nil {
+		return err
+	}
+	g.SecretKey = raw
+	global.Log.WithField("func", fn).WithField("len", len(raw)).Debug("enrolled secret")
+	return g.Sync()
+}
+
+// CurrentCode returns the live TOTP for the receiver.
+func (g *GoogleAuthenticator) CurrentCode() (string, error) {
+	if g.SecretKey == nil {
+		return "", fmt.Errorf("authenticator: no secret loaded")
+	}
+	return g.CalculateTOTP(), nil
+}
+
+// SecretData / SetSecretData delegate to the embedded Base.
+func (g *GoogleAuthenticator) SecretData() string               { return g.EncodeSecretData() }
+func (g *GoogleAuthenticator) SetSecretData(value string) error { return g.DecodeSecretData(value) }
+
+// Sync issues a HEAD request against the configured vendor URL and reads
+// the response's Date header to derive ServerTimeDiff. Errors are swallowed
+// in the same way as the original C# implementation — repeated failures
+// should not block code generation, the local clock is the fallback.
+func (g *GoogleAuthenticator) Sync() error {
+	const fn = "internal.authenticator.GoogleAuthenticator.Sync"
+	logger := global.Log.WithField("func", fn).WithField("url", g.timeSyncURL)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, g.timeSyncURL, nil)
+	if err != nil {
+		logger.WithError(err).Warn("build request failed")
+		return err
+	}
+	resp, err := httpc.New().Do(req)
+	if err != nil {
+		logger.WithError(err).Warn("sync request failed; using local clock")
+		return nil
+	}
+	defer resp.Body.Close()
+
+	dateStr := strings.TrimSpace(resp.Header.Get("Date"))
+	if dateStr == "" {
+		logger.Warn("response missing Date header")
+		return nil
+	}
+	t, err := http.ParseTime(dateStr)
+	if err != nil {
+		logger.WithError(err).Warn("invalid Date header")
+		return nil
+	}
+	serverMs := t.UnixMilli()
+	g.ServerTimeDiff = serverMs - NowMillis()
+	g.LastServerTime = NowMillis()
+	logger.WithField("offset_ms", g.ServerTimeDiff).Debug("clock synced")
+	return nil
+}