Add TOTP extension

[imbriandev]

Summary

• Add a local-first TOTP authenticator with saved and quick OTP commands.
• Support encrypted AES-256-GCM backup export and import.

Test plan

• npm run lint
• npm run build
• npm run test

[raycastbot]

Congratulations on your new Raycast extension! 🚀

We're currently experiencing a high volume of incoming requests. As a result, the initial review may take up to 15 business days.

Once the PR is approved and merged, the extension will be available on our Store.

[greptile-apps]

Greptile Summary

The PR adds a local-first TOTP authenticator with saved and quick OTP commands plus encrypted backup import and export.

• Persists and manages TOTP accounts in Raycast LocalStorage.
• Generates OTPs from Base32 secrets and otpauth:// URIs.
• Encrypts exported backups with AES-256-GCM and imports validated account data.
• Adds extension metadata, documentation, tests, and Store assets.

Confidence Score: 3/5

The PR is not yet safe to merge because account mutations can still lose updates and a single backup can still import duplicate accounts.

Account operations continue to replace independently loaded snapshots of shared storage, while merge deduplication never adds accepted imports to its comparison set, leaving both previously reported data-integrity failures reachable.

Files Needing Attention: extensions/totp/src/accounts.ts

Important Files Changed

Filename	Overview
extensions/totp/src/accounts.ts	Adds account persistence and merge operations, but the previously reported lost-update race and within-backup duplicate import remain.
extensions/totp/src/backup.ts	Adds authenticated backup encryption and validation; the prior truncated-tag weakness is fixed.
extensions/totp/src/totp.ts	Implements Base32 parsing, otpauth URI handling, and TOTP generation without an accepted blocking finding.
extensions/totp/src/index.tsx	Provides the saved-account UI and actions without an accepted blocking finding in this follow-up.
extensions/totp/src/quick-otp.tsx	Provides unsaved OTP generation and account-saving actions without an accepted blocking finding.
extensions/totp/package.json	Defines valid extension metadata and now includes the previously missing schema reference.

_{Reviews (4): Last reviewed commit: "Improve account editing and secret visib..." | Re-trigger Greptile}

[pernielsentikaer]

Similar extensions already in the Store

Automated first pass. Overlap is not a blocker on its own, but the README should make the difference clear.

• One Time Password (one-time-password, 2,068 installs by @lacherogwu) — Generate time-based one-time passwords
  _{similarity 0.78}
• QOTP (qotp, 62 installs by @ariesly15) — QOTP is a simple tool to generate OTP code
  _{similarity 0.71}
• Proton Authenticator (proton-authenticator, 825 installs by @FareedFarag) — Quick access to TOTP entries from Proton Authenticator
  _{similarity 0.68}
• 2FAS Authenticator (2fas-authenticator, 15 installs by @LockeAG) — Search and copy TOTP codes from 2FAS exports with a Keychain-encrypted local vault
  _{similarity 0.64}
• Two-Factor Authentication Code Generator (two-factor-authentication-code-generator, 5,765 installs by @cjdenio) — Quickly access your two-factor authentication codes.
  _{similarity 0.62}