Web generator:
- Fixed: now uses Argon2id + correct message format (no salt)
- Added hash-wasm-argon2.js, loading indicator during strengthening

Tests:
- JS: 83 tests (extension/tests/test.mjs) — TOTP, SSH, wallet, sync, core
- Kotlin: TotpEngineTest (31), SshEngineTest (13), WalletEngineTest (23)
- All cross-platform vectors verified

UX features:
- Secret strength meter (extension + Android): entropy estimation
- QR scan for TOTP (Android): ML Kit barcode-scanning + CameraX
- Extension onboarding: 3-step first-time overlay
- Wallet saved list + audit log UI (extension + Android)
- Argon2id rate limit: 2s throttle prevents DoS

CI pipeline (.gitlab-ci.yml):
- test-python: pytest (119 tests)
- test-js: node extension/tests/test.mjs (83 tests)
- build-extension: bash extension/build.sh

Documentation:
- SPEC.md: added §11 TOTP, §12 SSH, §13 Wallet, §14 Domain Separation
- CHANGELOG.md: added [1.2.0] section
- HANDOVER.md: updated with all new features, corrected pending items