A test proves the terminal's app variables screen: an admin adds a masked value that is never drawn, toasted or logged, and unsets one after a confirm #7591

src/tui/screens/appenv.ts (#7232) holds secret values and has no test of its own; this pins its promises.

Done when

• [ ] New test/tui-appenv.test.ts boots the terminal as a repository admin, opens app variables from the repository's : palette, presses a, types a name, a value and a scope
• [ ] The typed value appears in no frame, no toast and no log line the test can capture; the name and scope are listed after the save
• [ ] d on the row asks first; declining keeps it, confirming unsets it, as listAppEnv then shows
• [ ] A non-admin is not offered the palette entry, and a bad name is refused in the same words as MCP app_env (APP_ENV_ERRORS)
• [ ] Each assertion fails if the corresponding line of appenv.ts is broken (say which you tried)

Files: test/tui-appenv.test.ts (new)

Risks. Reaching the screen goes through the workspace palette; drive it, do not edit src/tui/screens/workspace.ts (hot).

Suggested brief: torque (a person assigns).