feat(vault): M5 slice 4 — TUI mutations: add / edit / delete

[UnbreakableMJ]

Summary

Makes PRD §7.2's Mutation row live — a add, e edit, d delete (confirm) — completing the TUI's daily-driver loop (browse → search → reveal/copy → mutate) without falling back to the CLI.

Pure TUI slice: the agent's M4 write paths (Request::Add / Edit / Remove) are driven as-is. No protocol changes, no agent changes, no new dependencies.

Add (a)

• Centered form overlay with a Type row (login ⇄ secure note, toggled with Space/←/→) over Name / User / Pass / URI / Folder / Notes; secure notes expose only Name / Folder / Notes.
• Tab/↓ and Shift-Tab/↑ cycle fields (wrapping); Enter validates (name required) and submits; Esc discards.
• Ctrl+G in the Pass field fills it with a fresh default-options password (vault-core::generate_password) — the PRD's "generate into the active field" user story.
• Values typed under one type survive a toggle, but hidden login fields never leak into a secure-note submit (tested).

Edit (e)

• Same form, prefilled from the list metadata (name / username / folder); type fixed; targets the selected row's exact cipher id.
• Submit diffs against the prefill: untouched fields ride as None on the wire (a password the form never saw is never re-encrypted), a cleared field submits empty, and a no-change edit is rejected in-form.

Delete (d)

• Delete 'name'? y/N confirm overlay; y/Enter sends Request::Remove by exact id, n/Esc backs out untouched.

Behavior

• Success reloads the vault with a saved '…' / deleted '…' toast; on any error the form stays open so nothing typed is lost.
• Mutation overlays re-mask revealed secrets; the unfocused Pass field renders masked; FormState / FormSubmit redact secrets in Debug.

Known deviation (tracked in CHANGELOG)

PRD §7.2's full CUA bindings (Ctrl+C/X/V/Z/S/F) and bracketed paste in text inputs are deferred — fields accept typed input only this slice.

Tests

11 new app units (form open/prefill/gating, focus wrap, type-toggle value preservation, Ctrl+G targeting, submit diff/validation, note-residue exclusion, confirm gating/take/cancel, overlay re-masking, Debug redaction) + 2 TestBackend smokes (form overlay with masked unfocused Pass; confirm overlay). Workspace total: 102 tests, 0 failures; clippy -D warnings (pedantic+nursery) and cargo deny clean.

🤖 Generated with Claude Code