[ardakrt]

Malformed account keys could disable all codes, migration QR input could hang the renderer or import HOTP as TOTP, and selected accounts were saved individually. PIN unlock also left the account view stale, inactivity locking was not enforced, pending sensitive operations could finish after locking, and grouped accounts could be silently skipped during backup recovery.

This change validates Base32 consistently, bounds migration parsing, isolates unreadable accounts and imports QR accounts atomically. Main now enforces inactivity locking and locks on OS lock/suspend, publishes validated status events, and invalidates captured sessions across locks. The renderer unmounts sensitive state while locked and reloads accounts immediately after unlock. Code delivery, clipboard writes, account writes and backup operations recheck the captured session after asynchronous work.

Backup payload v2 includes group metadata and restores groups/accounts in one SQLite transaction. Legacy v1 backups remain readable; missing old group metadata restores the affected accounts ungrouped with an explicit notice. Encryption or database failures abort recovery instead of reporting partial success. The encryption envelope, KDF and existing database schema are unchanged. Version 2 payloads require Authly 0.3.11 or newer to import.

Bumps the app to 0.3.11 and documents the release in CHANGELOG.md and SECURITY.md.

Validation:

• npm run verify: passed on Windows, 19 files and 93 tests; format, lint, TypeScript, production build and real Electron smoke.
• Regression tests cover unlock reload, sensitive-state clearing, main-process inactivity/OS-idle checks, lock/unlock cancellation of pending work, grouped and legacy backup recovery, and complete rollback on encryption/database errors.
• The real Electron smoke exercises validated preload/main account CRUD, TOTP generation, invalid input, atomic import failure and PIN lock/unlock view reload using isolated storage.
• Built the packaged Windows app with electron-builder --win dir --x64 --publish never; launched its Authly.exe with isolated smoke storage and observed PACKAGED_AUTHLY_0.3.11_SMOKE_READY.
• npm audit: 0 vulnerabilities; git diff --check: passed.
• ACKit: 0 Critical. Its CI scan still flags 842 existing High entries in npm lock metadata and three package metadata entries; no scanner suppressions or gate changes.

Release plan: after GitHub Windows/Linux CI and CodeQL pass, merge this PR and push v0.3.11 to run the existing Windows NSIS/Linux AppImage+deb release pipeline.