feat: replace profiles with kubernetes-style secrets

Replace the confused Profile abstraction with a dedicated Secret resource
following Kubernetes conventions. Servers now have env entries with inline
values or secretRef references. Env vars are resolved and passed to
containers at startup (fixes existing gap).

- Add Secret CRUD (model, repo, service, routes, CLI commands)
- Server env: {name, value} or {name, valueFrom: {secretRef: {name, key}}}
- Add env-resolver utility shared by instance startup and config generation
- Remove all profile-related code (models, services, routes, CLI, tests)
- Update backup/restore for secrets instead of profiles
- describe secret masks values by default, --show-values to reveal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/cli/tests/commands/project.test.ts

@@ -21,32 +21,9 @@ describe('project command', () => {
     output = [];
   });
 
-  describe('profiles', () => {
-    it('lists profiles for a project', async () => {
-      vi.mocked(client.get).mockResolvedValue([
-        { id: 'prof-1', name: 'default', serverId: 'srv-1' },
-      ]);
-      const cmd = createProjectCommand({ client, log });
-      await cmd.parseAsync(['profiles', 'proj-1'], { from: 'user' });
-      expect(client.get).toHaveBeenCalledWith('/api/v1/projects/proj-1/profiles');
-      expect(output.join('\n')).toContain('default');
-    });
-
-    it('shows empty message when no profiles', async () => {
-      const cmd = createProjectCommand({ client, log });
-      await cmd.parseAsync(['profiles', 'proj-1'], { from: 'user' });
-      expect(output.join('\n')).toContain('No profiles assigned');
-    });
-  });
-
-  describe('set-profiles', () => {
-    it('sets profiles for a project', async () => {
-      const cmd = createProjectCommand({ client, log });
-      await cmd.parseAsync(['set-profiles', 'proj-1', 'prof-1', 'prof-2'], { from: 'user' });
-      expect(client.put).toHaveBeenCalledWith('/api/v1/projects/proj-1/profiles', {
-        profileIds: ['prof-1', 'prof-2'],
-      });
-      expect(output.join('\n')).toContain('2 profile(s)');
-    });
+  it('creates command with alias', () => {
+    const cmd = createProjectCommand({ client, log });
+    expect(cmd.name()).toBe('project');
+    expect(cmd.alias()).toBe('proj');
   });
 });