Add application password lock with multi-monitor OLED protection

[ZheLZZ]

Adds an optional application password lock for automatic absence detection and the tray menu. It covers every display while Windows keep-awake requests allow background work to continue. Windows system lock remains the default.

Behavior

• Independent salted PBKDF2 password, including empty passwords; settings show whether a password exists and allow direct changes while unlocked.
• Landscape lock screen with live clock/date, primary-screen password entry, and monitor-layout/DPI recovery that preserves existing covers and typed input.
• Optional OLED mode after three idle minutes: a moving clock, date and accent line on black; the first input restores the password screen without unlocking.
• Manual lock restores the previous monitoring state. Temporary shortcut recovery has been removed from the final source and package.
• Includes updated settings/privacy/security documentation and a Windows/Python 3.13 regression workflow.
• Corrects stale retry countdown feedback; checks wallpaper resources before packaging and runs packaged validation on an isolated desktop.

Validation

• 92 unit/regression tests, tracked Python compilation and pip check passed.
• GitHub Windows/Python 3.13 CI passed on the final commit, using current Node 24 Actions releases.
• python tools/validate_app_lock.py --full-self-test passed on an isolated desktop: native windows/hooks, password/manual lock, OLED wake, two/three-display simulations, negative coordinates, portrait/primary/DPI changes and transient display failures. Physical hotplug still needs hardware acceptance.
• Full EXE build and isolated packaged self-test passed; lightweight ZIP contents and SHA-256 verified.

Application lock is a normal-process overlay, not the Windows secure desktop. Existing administrator/process-termination/system-policy limitations are documented in SECURITY.md. No mouse/keyboard simulation or persistent Windows power-policy changes are added.