feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/authenticator/hotpauthenticator.go

@@ -0,0 +1,74 @@
+package authenticator
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"git.wxccs.org/iceking2nd/winauth-go/internal/global"
+)
+
+// HOTPAuthenticator implements RFC 4226 counter-based HOTP.
+type HOTPAuthenticator struct {
+	Base
+	Counter uint64
+}
+
+// NewHOTPAuthenticator returns a fresh HOTP authenticator with the project
+// defaults (6 digits, SHA1).
+func NewHOTPAuthenticator() *HOTPAuthenticator {
+	return &HOTPAuthenticator{Base: NewBase()}
+}
+
+// Name returns the short logger tag for this type.
+func (h *HOTPAuthenticator) Name() string { return "hotp" }
+
+// Enroll loads the secret from a base32 string and optionally seeds the
+// counter.
+func (h *HOTPAuthenticator) Enroll(b32 string, counter uint64) error {
+	const fn = "internal.authenticator.HOTPAuthenticator.Enroll"
+	raw, err := Base32Decode(b32)
+	if err != nil {
+		return err
+	}
+	h.SecretKey = raw
+	h.Counter = counter
+	global.Log.WithField("func", fn).WithField("counter", counter).Debug("enrolled HOTP")
+	return nil
+}
+
+// CurrentCode increments the internal counter and returns the resulting code.
+func (h *HOTPAuthenticator) CurrentCode() (string, error) {
+	if h.SecretKey == nil {
+		return "", fmt.Errorf("authenticator: no secret loaded")
+	}
+	h.Counter++
+	digits := h.CodeDigits
+	if digits == 0 {
+		digits = DefaultCodeDigits
+	}
+	return hotpCode(h.SecretKey, h.Counter, digits, h.HMACType), nil
+}
+
+// Sync is a no-op for HOTP — there is no server clock to align against.
+func (h *HOTPAuthenticator) Sync() error { return nil }
+
+// SecretData appends "|<counter>" to the base secret data string, matching
+// the C# HOTPAuthenticator.SecretData getter.
+func (h *HOTPAuthenticator) SecretData() string {
+	return h.EncodeSecretData() + "|" + strconv.FormatUint(h.Counter, 10)
+}
+
+// SetSecretData parses the "<base>|<counter>" form.
+func (h *HOTPAuthenticator) SetSecretData(value string) error {
+	if err := h.DecodeSecretData(value); err != nil {
+		return err
+	}
+	if idx := strings.Index(value, "|"); idx >= 0 {
+		c, err := strconv.ParseUint(strings.TrimSpace(value[idx+1:]), 10, 64)
+		if err == nil {
+			h.Counter = c
+		}
+	}
+	return nil
+}