App-Sperre mit Passwort und/oder FIDO2-Sicherheitsschlüssel (PRF/hmac-secret): Vault zusätzlich verschlüsselt, Sperrbildschirm, Strg+Shift+L, automatische Sperre

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -40,6 +40,7 @@ sudo pacman -S freerdp gnome-keyring   # use kwallet instead of gnome-keyring on
 - **Backup** export and import
 - **7 app themes** (Midnight, Navy, Nord, Dracula, Catppuccin, Forest, Light) plus a custom accent color
 - **Encrypted vault** using your operating system's keyring (Windows DPAPI, Linux libsecret/KWallet)
+- **App lock** with a password and/or a FIDO2 security key such as a YubiKey. The vault is then additionally encrypted, and it can lock automatically when you're inactive
 - **Automatic updates**: MrTerm checks for new versions on startup and can install them for you
 
 ## Getting started
@@ -61,9 +62,22 @@ For a quick one-off connection, press `Ctrl+Shift+K` and type `user@host` (or `r
 | `Ctrl+Shift+C` / `Ctrl+Shift+V` | Copy / paste in the terminal |
 | `Ctrl+Shift+F` | Search in the terminal |
 | `Ctrl` + `+` / `-` / `0` | Font size |
+| `Ctrl+Shift+L` | Lock MrTerm |
 
 `Ctrl+W`, `Ctrl+K` and `Ctrl+T` still reach the terminal, so editors like nano work as usual.
 
+## App lock
+
+Under **Settings → App lock** you can protect MrTerm with a password, one or more FIDO2 security keys (e.g. YubiKey), or both. Once a method is set up:
+
+- MrTerm starts locked, and your hosts, keys and passwords stay encrypted until you unlock it.
+- Lock it any time with the lock icon in the title bar or `Ctrl+Shift+L`, or let it lock automatically after a period of inactivity.
+- Open sessions keep running in the background while MrTerm is locked.
+
+Security keys need to support the *hmac-secret* (PRF) extension, which YubiKey 5 and most current FIDO2 keys do. Touching the key is enough, no PIN is needed. On Linux, the key must be accessible to your user. This is the default on Arch/CachyOS.
+
+**Keep in mind:** if you forget the password and lose all registered security keys, your vault cannot be recovered. Setting up a second unlock method is a good idea.
+
 ## Updates
 
 MrTerm looks for updates on startup. You can also check manually under **Settings → Updates**. When a new version is available, click **Install now** and MrTerm will download the right package for your system and restart.