feat(lock): main-window lock screen; harden env gating, sandbox and ssh teardown

Lock screen (main-window overlay, no second window):
- scrypt password verifier in <userData>/lock.json (per-write salt,
  timingSafeEqual); salt/hash/password never leave the main process
- lock now / idle auto-lock / lock at startup, growing failure cooldown,
  lock flags persisted so a quit-and-relaunch cannot bypass the lock
- locked shell and body portals go inert while sessions keep running;
  menu accelerators (reload, DevTools, zoom) are swallowed while locked
- settings gains a Lock tab; all copy in zh-CN/zh-TW/en/ja

Security and stability:
- packaged builds ignore ELECTRON_RENDERER_URL / OT_UPDATE_URL (devEnv)
- renderer preload runs with sandbox: true
- unreadable known_hosts store fails closed instead of being overwritten
- connect-time secrets gated by the bookmark's auth method (connectPromptFor)
- ssh stream teardown is idempotent: PTY_EXIT broadcasts exactly once
- sysinfo polling is refcounted for split panes (forceStopPolling on close)
- session-log index entries are path-contained; settings store writes
  atomically with EPERM/EBUSY retry
- sync-changelog tolerates CRLF checkouts (was a silent no-op)
- retry ssh2 host-key generation (flaky malformed key, ~1/500)

Tests: lock-store + lock-controller suites; transport-death PTY_EXIT e2e;
GitHub Actions CI (typecheck + 10 offline tests + build)

src/shared/i18n/dicts/zh-TW/main.ts

@@ -17,6 +17,7 @@ const main: Record<string, string> = {
 
   'main.ssh.connectTimeout': '連線逾時 ({host}:{port})',
   'main.ssh.saveFingerprintFailed': '儲存主機指紋失敗: {detail}',
+  'main.ssh.knownHostsUnreadable': '已知主機檔案 (ssh_known_hosts.json) 存在但無法讀取，為避免覆寫已儲存的指紋，本次連線被拒絕。請修復或刪除該檔案後重試。',
   'main.ssh.hostKeyRejected': '使用者拒絕了主機指紋',
   'main.ssh.connectFailed': '連線失敗 {host}:{port}: {detail}',
   'main.ssh.shellOpenFailed': '無法開啟 SSH shell ({host}:{port}): {detail}',

src/shared/i18n/dicts/zh-TW/settings.ts

@@ -7,6 +7,7 @@ const settings: Record<string, string> = {
   'settings.tabs.highlight': '高亮',
   'settings.tabs.theme': '主題',
   'settings.tabs.system': '系統',
+  'settings.tabs.lock': '鎖定畫面',
   'settings.tabs.about': '關於',
   'settings.resizeHandle': '拖曳調整大小',
   'settings.preview': '預覽',
@@ -94,6 +95,49 @@ const settings: Record<string, string> = {
   'settings.system.shortcutPlaceholder': '點擊後按下快速鍵，留空為停用',
   'settings.system.shortcutConflict':
     '此組合鍵已被應用內快捷鍵佔用（Ctrl+= / Ctrl+- / Ctrl+0 / Ctrl+PgUp / Ctrl+PgDn），請換一個。',
+  'settings.lock.password.title': '鎖定密碼',
+  'settings.lock.password.desc': '設定密碼後才能啟用鎖定',
+  'settings.lock.password.configured': '已設定',
+  'settings.lock.password.notConfigured': '未設定',
+  'settings.lock.password.current': '目前密碼',
+  'settings.lock.password.currentPlaceholder': '請輸入目前密碼',
+  'settings.lock.password.new': '新密碼',
+  'settings.lock.password.newPlaceholder': '請輸入新密碼',
+  'settings.lock.password.confirm': '確認新密碼',
+  'settings.lock.password.confirmPlaceholder': '再次輸入新密碼',
+  'settings.lock.password.set': '設定密碼',
+  'settings.lock.password.change': '變更密碼',
+  'settings.lock.password.clear': '清除密碼',
+  'settings.lock.password.clearTitle': '清除鎖定密碼？',
+  'settings.lock.password.clearDesc': '清除後鎖定會一併關閉，需要目前密碼確認。',
+  'settings.lock.password.mismatch': '兩次輸入的新密碼不一致',
+  'settings.lock.password.empty': '請填寫密碼',
+  'settings.lock.password.saved': '密碼已儲存',
+  'settings.lock.password.cleared': '鎖定密碼已清除',
+  'settings.lock.password.forgot':
+    '忘記鎖定密碼無法透過雲端找回，也沒有後門：只能刪除本機鎖定資料後重新設定。',
+  'settings.lock.enabled': '啟用鎖定',
+  'settings.lock.enabledDesc': '閒置或啟動時鎖定主視窗，解鎖需要上面的密碼',
+  'settings.lock.needPassword': '請先設定鎖定密碼',
+  'settings.lock.autoLock': '閒置自動鎖定',
+  'settings.lock.autoLockDesc': '系統閒置超過該時間後自動鎖定（0 表示從不）',
+  'settings.lock.autoLockOff': '關閉',
+  'settings.lock.autoLockMinutes': '{n} 分鐘',
+  'settings.lock.lockAtStartup': '啟動時鎖定',
+  'settings.lock.lockAtStartupDesc': '每次啟動後先要求輸入密碼',
+  'settings.lock.lockNow': '立即鎖定',
+  'settings.lock.lockNowDesc': '馬上鎖定主視窗（工作階段保持運作）',
+  'settings.lock.title': '已鎖定',
+  'settings.lock.screenDesc': '輸入鎖定密碼以解鎖',
+  'settings.lock.passwordPlaceholder': '密碼',
+  'settings.lock.unlock': '解鎖',
+  'settings.lock.unlocking': '解鎖中…',
+  'settings.lock.screenForgot': '忘記密碼？鎖定密碼無法找回，只能刪除本機鎖定資料。',
+  'settings.lock.error.invalidPassword': '密碼無效（不能為空或過短）',
+  'settings.lock.error.wrongPassword': '密碼錯誤',
+  'settings.lock.error.cooldown': '嘗試次數過多，請等待 {n} 秒後重試',
+  'settings.lock.error.cooldownGeneric': '嘗試次數過多，請稍後再試',
+  'settings.lock.error.saveFailed': '儲存失敗，請重試',
   'settings.resetTerminal': '恢復預設終端設定',
   'settings.resetTerminalTitle': '恢復預設終端設定？',
   'settings.resetTerminalDesc': '字體、游標、渲染與主題等全部終端設定將恢復為預設值。',