Add optional local data encryption with data.bin vault

[spotco]

Adds optional encryption for local LibreOTP data by migrating plaintext data.json storage into an encrypted data.bin vault.

This includes:

• AES-GCM encrypted local vault support using PBKDF2-HMAC-SHA256 key derivation
• Prefer data.bin over data.json when both exist
• Prompt to migrate existing plaintext local data into the encrypted vault
• Password dialogs for creating, unlocking, and changing the vault password
• Loading overlays while encrypted data is being unlocked, encrypted, or re-saved
• Tests for vault encryption, storage behavior, password dialogs, and state transitions

[spotco]

On load with plaintext json, prompts to encrypt local json (into a data.bin).

Prompts for password on encrypt.

On loading an encrypted vault, prompts for password.

(Password prompt)

And passwords on visible upon entering correct password!

data.bin (as opposed to data.json) is stored at:
C:\Users<USERNAME>\AppData\Roaming\com.henricook\LibreOTP\

[henricook]

Thanks @spotco ! Do you mind if I push a couple of minor amendments and then prompt you to take a look? Broadly though, looking good

[spotco]

yep, go ahead 👍