The terminal's resilience screen seals or forgets the off-box snapshot mirror, never showing a key, as MCP `mirror_set` does #7276

For: the owner making sure a lost machine loses nothing, from the terminal. Never lost means the second copy is set up from every door.

saveMirror and forgetMirror are reached from the Backups page and MCP mirror_set (src/http/mcp/tools/mirror_set.ts). The terminal's resilience screen (src/tui/screens/resilience.ts) only reads.

Done:

• [ ] The screen says where the mirror is (its place) or that there is none.
• [ ] M, for a forge admin who is a person, asks for endpoint, bucket, region, access key and secret key (the secret masked as typed); a blank field keeps what was sealed, as on the page; a refused field is named in the page's words.
• [ ] F forgets the mirror after a confirm.
• [ ] A new test/tui-mirror-set.test.ts: seal, read back without a key, keep a sealed key on a blank field, forget; no frame contains the access or secret key.

Files: src/tui/screens/resilience.ts, one test. Risk: medium; keys must never reach a frame or a log. Touches the same screen as the snapshot-destination issue, but with different keys, so either can land first.