Merge remote-tracking branch 'origin/master' into feature/totp-auth

scrt wsl stable (backup and recovery works, but can still be improved)

fix(wsl): run Windows Hello auth from CLI instead of daemon

feat(install): add scrt2 CLI to installer

feat(wsl): add keystore module, scrt3 CLI, Windows installer; remove dpapi

feat(wsl): separate 2FA toggle for unlock (2fa-on/off --unlock)

Rename 2fa-disable/2fa-reenable to 2fa-off/2fa-on

Add existing-secrets warning to setup-2fa

fix(wsl): resolve issues #5, #8, #11, #12 — GUI improvements

feat(wsl): add backup-key, recover, backup-vault, backup-guide, and GUI menu

feat(disaster-recovery): add WSL/Linux recovery scripts and update docs

feat(wsl): default setup-2fa to agent mode, suggest disabling after setup

fix(wsl): use zenity --forms for large verification code text

fix(wsl): remove raw markup from verification dialog

fix(wsl): robust secret parsing and single-dialog verification