feat: replace profiles with kubernetes-style secrets

Replace the confused Profile abstraction with a dedicated Secret resource
following Kubernetes conventions. Servers now have env entries with inline
values or secretRef references. Env vars are resolved and passed to
containers at startup (fixes existing gap).

- Add Secret CRUD (model, repo, service, routes, CLI commands)
- Server env: {name, value} or {name, valueFrom: {secretRef: {name, key}}}
- Add env-resolver utility shared by instance startup and config generation
- Remove all profile-related code (models, services, routes, CLI, tests)
- Update backup/restore for secrets instead of profiles
- describe secret masks values by default, --show-values to reveal

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/mcpd/tests/mcp-server-routes.test.ts

@@ -34,7 +34,7 @@ function mockRepo(): IMcpServerRepository {
         command: null,
         containerPort: null,
         replicas: data.replicas ?? 1,
-        envTemplate: [],
+        env: [],
         version: 1,
         createdAt: new Date(),
         updatedAt: new Date(),
@@ -55,7 +55,7 @@ function mockRepo(): IMcpServerRepository {
         command: null,
         containerPort: null,
         replicas: 1,
-        envTemplate: [],
+        env: [],
         version: 2,
         createdAt: new Date(),
         updatedAt: new Date(),