feat(ui): vendor 图标系统 + 应用图标占位

- 新增 tools/gen_icons 生成 7 张 vendor 占位 PNG + 256x256 应用图标
- internal/ui/vendor_icons.go 用 //go:embed 加载并按 Authenticator.Name() 查表
- entry 行圆环中心叠 16dp vendor 图标，HOTP 直接用图标占位
- 图标为通用色块 + 首字母，无第三方商标；用户可按文件名替换为真实 logo
- assets/README 说明替换方式与 Windows .syso 嵌入步骤

internal/ui/assets/README.md

@@ -0,0 +1,39 @@
+# UI assets
+
+## vendor_icons/
+
+Generated placeholder icons (64×64 PNG) used to identify each
+authenticator vendor in the entry list. They are intentionally generic —
+a coloured rounded square with a single white initial — so they carry no
+third-party trademark.
+
+To use real vendor logos, replace any individual file in place. The
+filename is the lookup key (matches `authenticator.Authenticator.Name()`):
+
+- `google.png`
+- `microsoft.png`
+- `okta.png`
+- `hotp.png`
+- `battlenet.png`
+- `steam.png`
+- `qr.png` — fallback for entries with an unknown vendor
+
+The recommended size is 64×64 PNG with transparent corners. Files are
+embedded at build time via `//go:embed` in `internal/ui/vendor_icons.go`.
+
+## app_icon.png
+
+A 256×256 placeholder for the application window/tray icon. Gio v0.7 has
+no runtime API to set the window icon — for Windows you need to embed a
+`.ico` resource via `rsrc` or `goversioninfo` at build time:
+
+```
+go install github.com/akavel/rsrc@latest
+rsrc -ico app.ico -o cmd/winauth/rsrc_windows.syso
+```
+
+To regenerate the placeholders, run:
+
+```
+go run ./tools/gen_icons
+```