Platform authentication such as Touch ID or Windows Hello instead of repeatedly entering a wallet password.

## Problem

Chrome extension users repeatedly enter their wallet password and expect the extension to support platform authentication such as Touch ID or Windows Hello.

This expectation appeared in UX research and was also discussed in the Wallet Product Sync. Mobile and the native desktop application already have platform-specific protection paths, but the Chrome extension intentionally uses password-based unlock.

## Product direction

Investigate optional platform-authenticated unlock for the Chrome extension on macOS and Windows.

The intended experience should:

- allow existing users to enable it without recreating their wallet;
- retain the wallet password as a clear fallback;
- return safely to password unlock when platform authentication is unavailable, cancelled, or reset;
- keep recovery independent from a single device;
- preserve the current vault-encryption and authentication guarantees.

Scope the initial investigation to unlocking the extension. Transaction approval or additional reauthentication should remain separate unless the investigation shows that they must be designed together.

## Discovery outcome

Before implementation, document:

- whether secure platform-authenticated extension unlock is feasible;
- the supported browser and operating-system combinations and material limitations;
- enrollment, re-enrollment, device-loss, browser-profile-reset, and password-fallback behavior;
- security implications compared with the current encrypted password vault;
- a go/no-go recommendation and the proposed implementation scope.

## Related

- #103 covers Windows Hello failing in the native Windows application; it is separate from extension support.

Start by examining the Chrome extension's unlock flow, likely in the background service worker or popup scripts. Research the Web Authentication API (WebAuthn) and platform-specific APIs for macOS (Touch ID) and Windows (Windows Hello). Document feasibility, supported OS/browser combos, and security implications. The outcome is a go/no-go recommendation and implementation scope, not code.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.