feat: replace profiles with kubernetes-style secrets

Replace the confused Profile abstraction with a dedicated Secret resource
following Kubernetes conventions. Servers now have env entries with inline
values or secretRef references. Env vars are resolved and passed to
containers at startup (fixes existing gap).

- Add Secret CRUD (model, repo, service, routes, CLI commands)
- Server env: {name, value} or {name, valueFrom: {secretRef: {name, key}}}
- Add env-resolver utility shared by instance startup and config generation
- Remove all profile-related code (models, services, routes, CLI, tests)
- Update backup/restore for secrets instead of profiles
- describe secret masks values by default, --show-values to reveal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/cli/tests/commands/get.test.ts

@@ -67,16 +67,6 @@ describe('get command', () => {
     expect(text).not.toContain('createdAt:');
   });
 
-  it('lists profiles with correct columns', async () => {
-    const deps = makeDeps([
-      { id: 'p1', name: 'default', serverId: 'srv-1' },
-    ]);
-    const cmd = createGetCommand(deps);
-    await cmd.parseAsync(['node', 'test', 'profiles']);
-    expect(deps.output[0]).toContain('NAME');
-    expect(deps.output[0]).toContain('SERVER ID');
-  });
-
   it('lists instances with correct columns', async () => {
     const deps = makeDeps([
       { id: 'inst-1', serverId: 'srv-1', status: 'RUNNING', containerId: 'abc123def456', port: 3000 },