feat: add TUI settings and integrations

[aksOps]

Summary

• add a keyboard-driven TUI settings pane backed directly by the existing scoped store
• test unsaved AI and forge values through the shared guarded probes, with cancellation, timeouts, and credential-origin enforcement
• add/save/test/remove forge integrations while locking saved identity and requiring a second removal confirmation
• keep persisted credentials write-only and cover state, storage, redaction, polling, and rendering with deterministic tests and a golden

Verification

• GOFLAGS=-buildvcs=false npm run coverage:go — pass, 96.5% total; TUI 94.0%; server 98.1%
• npm test — pass, 695 tests; 98.26% statement coverage
• npm run build — pass
• GOFLAGS=-buildvcs=false go build ./... — pass
• GOFLAGS=-buildvcs=false go vet ./... — pass
• GOFLAGS=-buildvcs=false go test -race ./... -count=1 — pass
• sh scripts/check-go-format.sh — pass
• git diff --check — pass

Security note

The activated clipboard transitive is the latest tagged github.com/atotto/clipboard v0.1.4, BSD-3-Clause, inherited from the already-pinned Bubbles text input. Local govulncheck found no reachable third-party dependency vulnerability, but did report nine reachable advisories in the installed Go 1.26.2 standard library, all fixed by Go 1.26.6. This PR does not change the project toolchain.

Closes #94

[sonarqubecloud]

Quality Gate failed

Failed conditions
94.9% Coverage on New Code (required ≥ 95%)

See analysis details on SonarQube Cloud