feat(tui): redact secrets on paste in input box

[kajogo777]

Summary

When users paste content containing secrets (API keys, passwords, tokens), automatically detect and redact them with [REDACTED_SECRET:rule-id:hash] placeholders.

Changes

• Modified tui/src/services/handlers/input.rs to run pasted content through secret_manager.redact_and_store_secrets()
• Uses the same gitleaks-based detection as the MCP proxy
• The redacted placeholder appears directly in the input box as visual feedback
• Mapping is stored in the session's secrets.json so the agent can restore actual values when executing commands

How it works

1. User pastes export API_KEY=sk-abc123xyz789...
2. TUI detects the API key pattern and substitutes it: export API_KEY=[REDACTED_SECRET:generic-api-key:a1b2c3]
3. User sees the redacted version in the input box
4. When the agent uses this in a command, the MCP proxy restores the actual secret before execution

Testing

• Build passes: cargo check --package stakpak-tui
• Tested with various secret patterns (AWS keys, API tokens, etc.)