[squarepots]

What changed

• Added an explicit Import from this computer flow with no startup scan, watcher, scheduler, or background sync.
• Added fixed Official Codex and Cockpit Tools discovery with bounded plaintext/encrypted read-only decoding, sanitized previews, default selection of new accounts, stale-preview revalidation, and normal intake reuse.
• Added English/Chinese UI copy, tests, and architecture/workflow/security/design/testing documentation.

Why

Users can discover and selectively import supported local Codex accounts without exposing credentials to the WebView or modifying Cockpit storage.

Validation

• cargo test --locked: 76 passed, 1 ignored
• cargo clippy --locked --all-targets -- -D warnings
• cargo fmt --check
• pnpm test: 33 passed
• pnpm build
• git diff --check

Remaining

The external SignPath Foundation application remains separate/TBD; Windows Authenticode is not part of this change.