feat: bulk JSON import for one-time codes; honour stored digits/period

[pyramation]

Summary

Adds bulk import of authenticator JSON exports ([{ name, secret, uri }, ...]) to the Codes tab, and fixes code generation for non-default entries.

• New parseTotpJsonExport(json) in src/shared/totp-import.ts: prefers each entry's otpauth:// URI (it carries digits/period/algorithm); falls back to name+secret as a default 6-digit/30s entry. Throws on malformed files, per-entry failures are reported individually.
• TotpScreen gains an "Import JSON file" button (hidden file input) that imports every entry via the existing totp.importUri IPC and toasts a summary.
• Bug fix: entries with custom parameters (e.g. Coinbase's digits=7&period=10) previously generated wrong codes — totpImportUri never stored digits, and both VaultService.totpEntry and dcrypt vault totp hardcoded { period: 30, digits: 6 }. Both now read the stored period/digits fields:

const period = await numericField('period', 30);
const digits = await numericField('digits', 6);
const code = await vault.totpCode(itemId, { period, digits });

Desktop tests (17) and CLI tests (30) pass; build + lint clean.

Link to Devin session: https://app.devin.ai/sessions/04636534e07048089ffb6b78142e12cd
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring