The terminal lists your OAuth apps for connecting origins, adds one and removes one, never reading back a secret, as MCP `origin_apps` does #7291

For: the owner who wants to mirror their GitHub work into the forge and is in the terminal. Fork tree starts with connecting where code already lives.

listOriginApps, registerOriginApp and deleteOriginApp are reached from settings and MCP origin_apps (src/http/mcp/tools/origin_apps.ts). No terminal screen calls them.

Done:

• [ ] A new src/tui/screens/originapps.ts, opened from the account palette as "Origin apps". Each row: host or kind, client id, and whether a secret is set (hasSecret), never the secret.
• [ ] a asks for a host (or github), client id and client secret (masked as typed) and registers it; a refusal is in MCP's words.
• [ ] d removes the selected one after a confirm.
• [ ] A new test/tui-originapps.test.ts: add, list without the secret, refuse a bad host, remove; no frame contains the secret.

Files: src/tui/screens/originapps.ts, src/tui/forge.ts, one test. Risk: medium; the secret must never reach a frame or a log.