The terminal registers, rotates and revokes an app too #30

Pull #22 gave the page and the JSON API the full set — register, rotate, revoke — and the terminal only p, a read-only listing. AGENTS.md says what a person can do on the page they can do in src/tty.ts, so the terminal is a door short of the others. The pull says so plainly and the README documents the limit; this is the follow-up it points at.

Done looks like

• [ ] src/tty.ts grows the writes beside p: a key to register (prompt for an id, then a name, the same two-field flow the page has), a key to rotate the app under the cursor, a key to revoke it. They call registerApp, rotateAppKey and revokeApp and decide nothing themselves — the admin-only rule already lives in the actions, so a guest or a plain user pressing them sees the action's own refusal on the status line, exactly as p does now.
• [ ] The apps view has a cursor of its own, or p toggles between notes and apps; whichever, the key legend at the foot says what is available to the role at the keyboard, as it does today.
• [ ] A freshly issued key prints once, on its own line, selectable, with the same sentence the page uses — and never again: no redraw, no scrollback rewrite and no status line repeats it. Nothing about a key reaches said, which is redrawn on every keystroke.
• [ ] src/tty.ts needs its identity key the way src/routes.ts now takes one: appSecret is threaded, not read from the environment inside the module. src/env.ts already exports identityKey for the process that has one; read it once at the top of tty.ts and pass it in, and print the action's unavailable message when there is none.
• [ ] A write made at the terminal reaches web viewers live like any other — the terminal is a second process, so today it does not; say so in the README where the terminal is described, or move the bus to something both processes share (a separate issue if it is the second).
• [ ] Tests: src/tty.ts has no seam for one today (it opens the database and grabs stdin at import). Give it one — a function that takes (db, who, identityKey) and returns the key handler — and test that a non-admin's keypress refuses, that a register prints a key once, and that a second redraw does not contain it.

Files: src/tty.ts, src/tty.test.ts, README.md

Risks: the status line is redrawn constantly, so a key held in said would be printed over and over — keep the issued key out of any redrawn state. Prompting for two fields in a raw-mode handler is the fiddly part; the existing typing flow is the pattern to copy.

While this is in flight: a registration made in the terminal will not reach an open page, because src/live.ts is the web process's bus and the terminal is a second process on the same file. That is not this issue's job to fix — #65 adds the watcher that closes it — so don't build a second notification path here. Say plainly in the pull that a terminal registration shows on the next load until #65 lands, and keep calling the same actions so the watcher picks the row up unchanged.