fix(otp): parse KeeOTP TOTP query fields

[ftorga]

Closes #9

Summary

• Parse KeeOTP TOTP query payloads from supported entry fields.
• Decode declared secret encodings safely and feed existing TOTP consumers.
• Keep HOTP out of this slice.

Changes

File	Change
KeeForge/Models/EncryptedValue.swift	Tightened secret handling for OTP payload decoding
KeeForge/Models/Entry.swift	Added KeeOTP-aware TOTP wiring
KeeForge/Models/KDBXParser.swift	Parsed KeeOTP TOTP query fields
KeeForge/Models/TOTPGenerator.swift	Adapted TOTP generation inputs
KeeForgeTests/KDBXParserTests.swift	Added parser coverage
KeeForgeTests/TOTPGeneratorTests.swift	Added generator coverage

Test Plan

• Unit tests added for parser and generator behavior
• Existing TOTP flows preserved
• HOTP intentionally deferred

Checklist

• Linked issue fix: recognize KeeOTP TOTP query fields #9
• Conventional commit format
• No Co-Authored-By trailers
• Repository-specific labels are not configured in this fork/upstream pair yet

[crazytan]

Thanks for the focused compatibility work. I found two blocking correctness issues that should be addressed before merge. I also ran the relevant unit-test slice locally; it completed with one failure in KDBXParserTests.testKeeOTPSupportsEachDeclaredEncodingWithoutFallback() (the over-padded Base64 case). TOTPGeneratorTests and EncryptedValueTests passed. There are currently no GitHub workflow runs/statuses attached to this commit.

Please also add the required CHANGELOG.md entry under ## Unreleased for this bug fix.

[crazytan]

[P1] Make Base64 decoding strict. Data(base64Encoded:) accepts the over-padded JBSWY3DP====, so this branch creates a TOTPConfig even though the declared Base64 spelling is malformed. This is why the PR's own testKeeOTPSupportsEachDeclaredEncodingWithoutFallback fails. Please validate canonical Base64 characters/padding (or round-trip decoded bytes to the canonical representation) before accepting the secret.

[crazytan]

[P1] Preserve the decoded secret/source encoding through edits. EntryDraftPayload and DatabaseDraft.makeTOTPConfig do not carry decodedSecret, so an unrelated entry edit reconstructs Base64/Hex/UTF-8 secrets as ordinary Base32 and breaks TOTP generation. For uppercase OTP/Otp, serialization also writes conflicting TimeOtp-* fields alongside the original custom field, and those fields take precedence on reload. Please preserve the KeeOTP source/encoding or decoded bytes through the edit and serialization pipeline, with an edit/save regression test.