feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/ui/entry_ring.go

@@ -0,0 +1,58 @@
+package ui
+
+import (
+	"image/color"
+	"time"
+
+	"gioui.org/layout"
+	"gioui.org/unit"
+
+	"git.wxccs.org/iceking2nd/winauth-go/internal/authenticator"
+)
+
+// entryProgressRing draws the per-row TOTP countdown ring. For HOTP
+// entries it returns a same-sized blank box so the rows still line up.
+func entryProgressRing(gtx layout.Context, en *entry) layout.Dimensions {
+	const ringDp = 22
+	if en.Auth == nil || en.Auth.Name() == "hotp" {
+		return layout.Dimensions{Size: gtx.Constraints.Constrain(
+			layout.Spacer{Width: unit.Dp(ringDp), Height: unit.Dp(ringDp)}.Layout(gtx).Size,
+		)}
+	}
+	period := totpPeriod(en.Auth)
+	if period <= 0 {
+		period = authenticator.DefaultPeriod
+	}
+	now := time.Now().Unix()
+	elapsed := now % int64(period)
+	remaining := int64(period) - elapsed
+	progress := float32(remaining) / float32(period)
+
+	fg := color.NRGBA{R: 0x10, G: 0x70, B: 0xff, A: 0xff}
+	if remaining <= 5 {
+		fg = color.NRGBA{R: 0xd0, G: 0x30, B: 0x30, A: 0xff}
+	}
+	bg := color.NRGBA{R: 0xd8, G: 0xd8, B: 0xd8, A: 0xff}
+
+	return progressRing{
+		Size:     unit.Dp(ringDp),
+		Stroke:   unit.Dp(2.5),
+		Progress: progress,
+		Color:    fg,
+		BgColor:  bg,
+	}.Layout(gtx)
+}
+
+// totpPeriod extracts the configured period from any authenticator whose
+// underlying Base we can reach. Returns 0 if the authenticator does not
+// expose one (in which case callers fall back to the default).
+func totpPeriod(a authenticator.Authenticator) int {
+	type periodGetter interface{ GetPeriod() int }
+	if pg, ok := a.(periodGetter); ok {
+		return pg.GetPeriod()
+	}
+	// All current TOTP-like authenticators (Google/Microsoft/Okta/Steam/
+	// BattleNet) embed authenticator.Base whose default period is 30s,
+	// matching the C# original. Hard-code that here.
+	return authenticator.DefaultPeriod
+}