feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/config/model.go

@@ -0,0 +1,29 @@
+// Package config defines the persistent shape of a winauth-go config and
+// provides loaders for both the new YAML format and the legacy WinAuth
+// XML format produced by the original C# application.
+package config
+
+// Entry is a serialized authenticator inside the config file. Vendor
+// determines how Data is interpreted by the authenticator package's
+// SetSecretData method.
+type Entry struct {
+	Name      string `yaml:"name"      json:"name"`
+	Vendor    string `yaml:"vendor"    json:"vendor"` // google|microsoft|okta|hotp|battlenet|steam
+	IconName  string `yaml:"icon"      json:"icon,omitempty"`
+	SecretRaw string `yaml:"secret"    json:"secret"` // value returned by Authenticator.SecretData()
+	// Hotkey is a human-readable global hotkey like "Ctrl+Alt+G". Empty
+	// means no hotkey. Parsed by internal/hotkey.Parse — invalid strings
+	// log a warning at registration time and are otherwise ignored.
+	Hotkey string `yaml:"hotkey,omitempty" json:"hotkey,omitempty"`
+}
+
+// Config is the top-level file shape. Entries are stored unencrypted by
+// default; if Encrypted is true, EncryptedBlob holds a WAGO1 base64 ciphertext
+// produced by internal/crypto.EncryptModern and Entries is empty on disk.
+type Config struct {
+	Version       int     `yaml:"version" json:"version"`
+	Language      string  `yaml:"language,omitempty" json:"language,omitempty"`
+	Encrypted     bool    `yaml:"encrypted" json:"encrypted"`
+	EncryptedBlob string  `yaml:"encrypted_blob,omitempty" json:"encrypted_blob,omitempty"`
+	Entries       []Entry `yaml:"entries,omitempty" json:"entries,omitempty"`
+}