Add YubiKey extension

[LLawli]

YubiKey

Use a YubiKey from Vicinae: TOTP codes, FIDO2 passkeys and PIV certificates.

The distinguishing point is that it is fully native and dependency-free. It does
not shell out to ykman/yubikit, needs no Python, and bundles no native addon. Every
protocol is implemented in pure TypeScript on Node's standard library:

• OATH and PIV over CCID, by speaking the pcscd winscard_msg protocol directly
  over its Unix socket.
• FIDO2 over HID (CTAPHID + canonical CBOR + PIN/UV protocol v1/v2) via
  /dev/hidraw.
• The OATH access key is read from the Secret Service over a small hand-written
  D-Bus client (imported from ykman's keystore when present, so no password prompt in
  the common case).

The only runtime requirement is a running pcscd (present on virtually every Linux
desktop), plus the standard FIDO udev rule for the passkey screen. Missing tools are
detected and reported with install guidance.

Commands

• OTP Codes — lists the TOTP codes with a per-account countdown; the primary action
  pastes the selected code into the focused field. Touch-required accounts ask for the
  touch before pasting.
• Keys & Certificates — enumerate/delete FIDO2 passkeys; view and export PIV
  certificates. The PIN is asked in-app and kept only in memory.

Notes for review

• Not a duplicate of the existing otp extension. That one is a software OTP
  manager (stores TOTP/HOTP secrets). This one reads codes from a physical YubiKey and
  also handles FIDO2/PIV; it does nothing without the hardware key plugged in.
• Clipboard history: because Clipboard.paste() has no concealed flag (only
  copy() does), pasting a code writes it to Vicinae's clipboard history in plaintext.
  The extension removes that entry right after pasting, and degrades gracefully (logs a
  warning, never breaks the paste) if the schema changes. An upstream concealed option
  on paste() would let us delete this code entirely.
• Interface in English and Portuguese, selectable via the Language preference.
• Design and protocol details are documented under extensions/yubikey/docs/.

Checks

Passes npm ci, vici build and vici lint locally. Preview images are HTML/CSS
mockups (fictitious data), not screenshots of real accounts.