feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。

核心模块：
- internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含
  enroll/sync/code 生成、Steam 交易确认轮询
- internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链）
- internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB
- internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) +
  SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换
- internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化
- internal/qr: gozxing 二维码解码 + otpauth:// URI 解析
- internal/i18n: en/zh-CN/de 三语 TOML

UI 模块 (Gio)：
- 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线
- 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板）
- 设置：密码加密、老版 XML 导入、每条目热键配置
- Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗

构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。

internal/win32/instance_windows.go

@@ -0,0 +1,96 @@
+//go:build windows
+
+package win32
+
+import (
+	"fmt"
+	"syscall"
+	"time"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// AcquireInstanceLock takes a named mutex so a second launch of
+// winauth-go can detect the first one. Returns a Release closer to be
+// deferred at program exit. If another instance is already running it
+// returns alreadyRunning=true and a zero Release; the caller may then
+// call ActivateOtherInstance(windowTitle) to bring the existing window
+// forward and exit.
+func AcquireInstanceLock(name string) (release func(), alreadyRunning bool, err error) {
+	wname, err := syscall.UTF16PtrFromString(name)
+	if err != nil {
+		return nil, false, fmt.Errorf("win32: utf16: %w", err)
+	}
+	h, err := windows.CreateMutex(nil, false, wname)
+	if h == 0 {
+		return nil, false, fmt.Errorf("win32: CreateMutex: %w", err)
+	}
+	// CreateMutex returns the existing handle when the name is taken; in
+	// that case GetLastError reports ERROR_ALREADY_EXISTS. err is set
+	// regardless of whether the handle is valid, so check the error
+	// number rather than err != nil.
+	if errno, ok := err.(syscall.Errno); ok && errno == windows.ERROR_ALREADY_EXISTS {
+		windows.CloseHandle(h)
+		return nil, true, nil
+	}
+	return func() { windows.CloseHandle(h) }, false, nil
+}
+
+// ActivateOtherInstance walks the top-level windows looking for one
+// whose title matches windowTitle, then restores + foregrounds it. The
+// match is exact. Used after AcquireInstanceLock reports a duplicate
+// launch.
+func ActivateOtherInstance(windowTitle string) error {
+	wtitle, err := syscall.UTF16PtrFromString(windowTitle)
+	if err != nil {
+		return err
+	}
+	hwnd, _ := findWindow(nil, wtitle)
+	if hwnd == 0 {
+		// The mutex says somebody is running, but the window isn't up
+		// yet — give it a brief moment then retry once.
+		time.Sleep(200 * time.Millisecond)
+		hwnd, _ = findWindow(nil, wtitle)
+	}
+	if hwnd == 0 {
+		return fmt.Errorf("win32: could not locate existing window %q", windowTitle)
+	}
+	const (
+		SW_RESTORE = 9
+	)
+	showWindow(hwnd, SW_RESTORE)
+	setForegroundWindow(hwnd)
+	return nil
+}
+
+// -----------------------------------------------------------------------------
+// raw syscall stubs — the windows package does not expose these directly.
+
+var (
+	user32                  = windows.NewLazySystemDLL("user32.dll")
+	procFindWindowW         = user32.NewProc("FindWindowW")
+	procShowWindow          = user32.NewProc("ShowWindow")
+	procSetForegroundWindow = user32.NewProc("SetForegroundWindow")
+)
+
+func findWindow(class, title *uint16) (windows.HWND, error) {
+	r, _, e := procFindWindowW.Call(
+		uintptr(unsafe.Pointer(class)),
+		uintptr(unsafe.Pointer(title)),
+	)
+	if r == 0 {
+		return 0, e
+	}
+	return windows.HWND(r), nil
+}
+
+func showWindow(hwnd windows.HWND, cmdShow int32) bool {
+	r, _, _ := procShowWindow.Call(uintptr(hwnd), uintptr(cmdShow))
+	return r != 0
+}
+
+func setForegroundWindow(hwnd windows.HWND) bool {
+	r, _, _ := procSetForegroundWindow.Call(uintptr(hwnd))
+	return r != 0
+}