fix: harden local key and database handling

[fyw3624]

Summary

• move database keys into native OS key stores with atomic generation switching
• validate SQLCipher pages, WAL frames, cache leases, paths, XML input, and scanner output at trust boundaries
• make init read-only by default and add doctor plus HMAC-verified keys import --stdin
• require an exact, verified client capability profile and explicit confirmation before any process-memory scan
• remove the unverified Windows V4 raw-pointer fallback

Verification

• python -m compileall -q wechat_cli tests
• python -m unittest discover -s tests -v — 34 passed, 2 POSIX-only permission tests skipped on Windows
• ruff check --select E4,E7,E9,F on the changed security modules and tests
• python npm/scripts/build.py win32-x64 — standalone EXE built successfully
• packaged wechat-cli.exe doctor --json — identified Weixin 4.1.13.12 and a valid Tencent signature with read_process_memory: false
• packaged wechat-cli.exe init --scan-memory --confirm-memory-scan — failed closed with WXCLI_SCAN_UNSUPPORTED_CLIENT before requesting process-memory read access

Real behavior proof

Behavior addressed: Initialization no longer performs an implicit process-memory scan, and untrusted key documents cannot become active state without real database-page HMAC proof.

Real environment tested: Windows 11 with signed Weixin.exe 4.1.13.12 running.

Exact steps or command run after this patch: Built the one-file Windows executable, ran doctor --json, then ran init --scan-memory --confirm-memory-scan against the detected local database directory.

Evidence after fix: The packaged binary reported read_process_memory: false, signature_valid: true, and WXCLI_SCAN_UNSUPPORTED_CLIENT; no generation became active.

Observed result after fix: Default and dry-run initialization remain read-only, and even fully confirmed scanning is rejected because no client version has completed acceptance yet.

What was not tested: No real process-memory scan was accepted; macOS and Linux native platform acceptance remain outstanding.