Modularize dotsec into lib/*.sh + per-engagement secret auto-generation

[Dxsk]

Summary

• Modularization: split the 968-line bin/dotsec monolith into 7 sourced lib/*.sh modules (ui, core, secrets, proxy, exegol, dashboard, engagement); bin/dotsec is now an ~80-line router. Iso-functional — function bodies moved verbatim, two dead functions dropped (__require_tmux, __tmux_spawn_session).
• Secrets: new lib/secrets.sh auto-generates per-engagement secrets on dotsec new, idempotently:
  • .env.secrets (chmod 600): DOTSEC_SESSION_SECRET, DOTSEC_API_TOKEN, MITMWEB_PASS
  • ephemeral ed25519 SSH key in keys/
  • mitmproxy CA in proxy/certs/
  • new commands dotsec secrets <target> (masked status) and dotsec rotate <target> [all|token|mitmweb|ssh|ca] (confirmation for destructive types).
  • wired into cmd_new, cmd_load (sourced through the command-substitution guard), and proxy_up (reads MITMWEB_PASS, legacy .web-pass fallback).
• Security/hygiene: .gitignore now excludes mitmproxy/certs/ + mitmproxy/flows/ (prevents committing the private CA key); strict permissions; secrets never printed in clear (except MITMWEB_PASS at proxy launch, as before).
• Robustness: fixed 3 set -e foot-guns, incl. a pre-existing one in __dotsec_load_global that aborted dotsec on any host without an exegol container.
• Quality: 23 bats tests, shellcheck-clean (.shellcheckrc), new make test/make lint targets and a CI lint job.

Test Plan

• make lint — shellcheck clean across bin/ + lib/
• make test — 23/23 bats tests pass
• Refactor verified iso-functional (function inventory + heredoc integrity + sampled bodies byte-identical to main)
• End-to-end: dotsec secrets/rotate exercised on a temp workspace; perms stay 600/700 after every rotate path; CA key confirmed never committed to history
• Manual smoke on a real engagement (dotsec new, proxy up, browser) — requires Docker/Exegol host