Concealed and secret clips are masked in the panel but written to the clipboard history file in plain text

## What happens

A copy marked `org.nspasteboard.ConcealedType` by a password manager is classified as `.secret` (`Sources/UttrflowClipboard/PasteboardWatcher.swift:127-138`), and so is a clip whose shape looks like a key, token or card number. A secret is masked in the panel until revealed, but `ClipboardStore` keeps it exactly like any other clip, so its text is written to the history file in Application Support in plain text.

#397 noted this as a separate decision. It also noted a related behaviour: a password manager that marks its copies only with `org.nspasteboard.TransientType` (and not `ConcealedType`) now has them dropped from history entirely rather than masked. `Docs/clipboard-secrets.md` (the table around line 114) describes each marker, but not this consequence for such a password manager.

## Why it matters

The panel's promise is that these stay hidden. A plain-text file of every password copied in the retention period is a better prize than the clipboard itself, for any process that can read the user's files, and for backups.

## Decision needed

1. Do not store secrets at all: they appear in the panel for the session only.
2. Store them encrypted, with a key in the Keychain.
3. Store them, but for a much shorter retention than other clips.
4. Keep today's behaviour and say so in `Docs/clipboard-secrets.md` and the Privacy copy.

And: is dropping `TransientType`-only copies from history the intended outcome for password managers that use only that marker?

## Acceptance criteria

- The decision is recorded in `Docs/clipboard-secrets.md`, including the `TransientType`-only case.
- Whatever is chosen has tests in `Tests/UttrflowClipboardTests` that read the history file from disk and show what a concealed clip leaves there.

Start with Sources/UttrflowClipboard/PasteboardWatcher.swift:127-138 and the ClipboardStore persistence path, then read Docs/clipboard-secrets.md around line 114. Review Tests/UttrflowClipboardTests and its history-file coverage. Done means the storage decision and TransientType-only behavior are documented, with tests showing what a concealed clip leaves on disk.

Written by the indexing model from the issue text.