feat(ui): disassociate secret storage from provider configuration

Related

• Builds on PR #113 (daemon N:1 secrets API, secret_name / secret_store, DR-047)
• Sibling pluggable backends: #114

Summary

Secrets and providers should be separate concerns (N providers → 1 named secret). The daemon API now supports that model (SetSecret / secret_name + secret_store, ConfigureProvider referencing an existing name — see PR #113 / DR-047), but the UIs still treat credential entry as part of provider add/edit.

Users should be able to:

1. Manage named secrets independently (add / list / update / delete; choose memory | keychain | env)
2. When configuring a provider, pick an existing secret_name rather than inventing a per-provider key

Desired outcome

Secrets management UI (web dashboard + VS Code provider panel)

• Dedicated Secrets surface (tab or equivalent) to create/list/delete named secrets
• Show presence / store kind only — never secret values in list views
• Support secret_store: memory | keychain | env (env = reference an exported variable)

Provider configuration

• Provider form selects secret_name (and optional store when writing a new value) instead of only embedding a raw API key that invents ${PROVIDER}_API_KEY
• Preserve a short legacy path for “paste key while adding provider” if needed, but prefer pick-existing

Context

• Backend landed in PR #113
• Follow-up to the N:1 secrets/providers design discussion
• Pluggable backends: #114

Acceptance criteria

• Web dashboard has a dedicated Secrets management surface
• VS Code extension exposes equivalent secrets management
• Provider configure flow can attach an existing named secret without re-entering the value
• List UIs never display secret values
• Docs updated (CONFIGURATION / dashboard help)

Start with PR #113 and DR-047 to understand the daemon secrets API, then inspect the web dashboard and VS Code provider panel entry points. Add the dedicated secrets-management surfaces and provider selection flow described in the acceptance criteria, keeping values out of lists. Update CONFIGURATION and dashboard help, and verify both UIs can attach named secrets without re-entering values.