feat: replace profiles with kubernetes-style secrets

Replace the confused Profile abstraction with a dedicated Secret resource
following Kubernetes conventions. Servers now have env entries with inline
values or secretRef references. Env vars are resolved and passed to
containers at startup (fixes existing gap).

- Add Secret CRUD (model, repo, service, routes, CLI commands)
- Server env: {name, value} or {name, valueFrom: {secretRef: {name, key}}}
- Add env-resolver utility shared by instance startup and config generation
- Remove all profile-related code (models, services, routes, CLI, tests)
- Update backup/restore for secrets instead of profiles
- describe secret masks values by default, --show-values to reveal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcpd/tests/mcp-server-service.test.ts

@@ -15,7 +15,7 @@ function mockRepo(): IMcpServerRepository {
       dockerImage: null,
       transport: data.transport ?? 'STDIO',
       repositoryUrl: data.repositoryUrl ?? null,
-      envTemplate: data.envTemplate ?? [],
+      env: data.env ?? [],
       version: 1,
       createdAt: new Date(),
       updatedAt: new Date(),
@@ -28,7 +28,7 @@ function mockRepo(): IMcpServerRepository {
       dockerImage: null,
       transport: 'STDIO' as const,
       repositoryUrl: null,
-      envTemplate: [],
+      env: [],
       version: 2,
       createdAt: new Date(),
       updatedAt: new Date(),