The terminal lists a forge admin's sealed secrets by name and sets or removes one, never showing a value #7238

For: a forge admin rotates a secret from the terminal. Today only the page and MCP secrets can.

listSecrets, putSecret and removeSecret are reached from /settings/secrets and MCP secrets, with scopes forge, org and repo. No terminal screen calls them.

Done:

• [ ] A new src/tui/screens/secrets.ts, opened from the admin palette as "Secrets". It lists names, scopes and timestamps, never values. a sets one: a scope, a ref, a name, and a value in a masked field. d removes one after a confirm.
• [ ] Only a forge admin sees the entry. The action's refusals read in its own words.
• [ ] A new test/tui-secrets.test.ts covers: set, the list shows the name, remove after a confirm, and a member without the entry. It also asserts that no frame ever contains the value.

Files: src/tui/screens/secrets.ts, the palette's entry list, one test. Risk: low. A value must never reach a frame or a log.