feat: replace profiles with kubernetes-style secrets

Replace the confused Profile abstraction with a dedicated Secret resource
following Kubernetes conventions. Servers now have env entries with inline
values or secretRef references. Env vars are resolved and passed to
containers at startup (fixes existing gap).

- Add Secret CRUD (model, repo, service, routes, CLI commands)
- Server env: {name, value} or {name, valueFrom: {secretRef: {name, key}}}
- Add env-resolver utility shared by instance startup and config generation
- Remove all profile-related code (models, services, routes, CLI, tests)
- Update backup/restore for secrets instead of profiles
- describe secret masks values by default, --show-values to reveal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/cli/tests/e2e/cli-commands.test.ts

@@ -21,7 +21,6 @@ describe('CLI command registration (e2e)', () => {
     expect(commandNames).toContain('apply');
     expect(commandNames).toContain('create');
     expect(commandNames).toContain('edit');
-    expect(commandNames).toContain('setup');
     expect(commandNames).toContain('claude');
     expect(commandNames).toContain('project');
     expect(commandNames).toContain('backup');
@@ -46,19 +45,11 @@ describe('CLI command registration (e2e)', () => {
     expect(subcommands).toContain('remove');
   });
 
-  it('project command has action subcommands only', () => {
+  it('project command exists with alias', () => {
     const program = createProgram();
     const project = program.commands.find((c) => c.name() === 'project');
     expect(project).toBeDefined();
-
-    const subcommands = project!.commands.map((c) => c.name());
-    expect(subcommands).toContain('profiles');
-    expect(subcommands).toContain('set-profiles');
-    // create is now top-level (mcpctl create project)
-    expect(subcommands).not.toContain('create');
-    expect(subcommands).not.toContain('list');
-    expect(subcommands).not.toContain('show');
-    expect(subcommands).not.toContain('delete');
+    expect(project!.alias()).toBe('proj');
   });
 
   it('displays version', () => {