Official app icon and Windows Hello unlock (beta)

Icons: the taskbar, title bar, tray and installer icons are now the Kestrove
mark (kestrel wing and keyhole on the Spruce tile) instead of the placeholder
keyhole. Generated with `tauri icon` from icons/kestrove-mark.svg, the brand
mark with the eye in the `accent` token (#b4481f), as the brand book asks.

Windows Hello (docs/02 "Local unlock"): Settings > General > "Unlock with
Windows Hello". Turning it on creates a TPM-backed KeyCredentialManager key
for this vault, which signs a fixed label plus a random salt; HKDF of the
deterministic RSA signature seals the core's Local Unlock Key with
XChaCha20-Poly1305 in windows-hello.json. The unlock screen then offers
"Unlock with Windows Hello" above the master password.

- The master password is still required every 14 days; Hello is not offered
  while it is due, and the LUK is kept.
- A cancelled prompt falls back to the password. The LUK is deleted only when
  Hello's key is gone or doesn't open it.
- Hello calls block, so they run on a blocking thread; the prompt is brought
  in front of the window.
- Not offered on Linux or where Windows Hello isn't set up.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/Cargo.lock

@@ -3016,9 +3016,11 @@ version = "1.1.0"
 dependencies = [
  "arboard",
  "base64 0.22.1",
+ "chacha20poly1305",
  "core-foundation",
  "getrandom 0.2.17",
  "hayro",
+ "hkdf 0.12.4",
  "image",
  "keyring",
  "kv-ffi",
@@ -3037,6 +3039,7 @@ dependencies = [
  "tokio",
  "url",
  "uuid",
+ "windows",
  "windows-sys 0.61.2",
  "zeroize",
 ]