Official app icon and Windows Hello unlock (beta)

Icons: the taskbar, title bar, tray and installer icons are now the Kestrove
mark (kestrel wing and keyhole on the Spruce tile) instead of the placeholder
keyhole. Generated with `tauri icon` from icons/kestrove-mark.svg, the brand
mark with the eye in the `accent` token (#b4481f), as the brand book asks.

Windows Hello (docs/02 "Local unlock"): Settings > General > "Unlock with
Windows Hello". Turning it on creates a TPM-backed KeyCredentialManager key
for this vault, which signs a fixed label plus a random salt; HKDF of the
deterministic RSA signature seals the core's Local Unlock Key with
XChaCha20-Poly1305 in windows-hello.json. The unlock screen then offers
"Unlock with Windows Hello" above the master password.

- The master password is still required every 14 days; Hello is not offered
  while it is due, and the LUK is kept.
- A cancelled prompt falls back to the password. The LUK is deleted only when
  Hello's key is gone or doesn't open it.
- Hello calls block, so they run on a blocking thread; the prompt is brought
  in front of the window.
- Not offered on Linux or where Windows Hello isn't set up.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/Cargo.toml

@@ -46,6 +46,9 @@ rqrr = { version = "0.11", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 hayro = { version = "0.8", default-features = false }
 tokio = { version = "1", features = ["time", "sync", "macros"] }
+# Windows Hello unlock (docs/02 "Local unlock"): a key derived from Hello's signature seals the LUK.
+hkdf = "0.12"
+chacha20poly1305 = "0.10"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
@@ -68,7 +71,10 @@ windows-sys = { version = "0.61", features = [
   "Win32_System_StationsAndDesktops",
   "Win32_System_SystemInformation",
   "Win32_UI_Input_KeyboardAndMouse",
+  "Win32_UI_WindowsAndMessaging",
 ] }
+# Windows Hello (KeyCredentialManager); the same version Tauri already pulls in.
+windows = { version = "0.62", features = ["Foundation", "Security_Credentials", "Security_Cryptography", "Storage_Streams"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 core-foundation = "0.10"