Add Go project scaffold for Wails v2 SSH/Telnet/RAW TCP client

- go.mod with Wails v2.9.2, x/crypto, go-sqlite3, go-keyring, uuid
- cmd/app/main.go: Wails entry point (Nexus Terminal, 1400x900, #1a1a2e)
- internal/app/app.go: lifecycle (Startup/Shutdown/DomReady)
- internal/models/models.go: full model definitions (Profile, SSHConfig,
  TelnetConfig, RAWConfig, SessionInfo, KnownHost, AppPreferences, etc.)
- internal/models/defaults.go: default values and NewProfile factory
- internal/validation/validation.go: thorough field-level validation
- frontend/embed.go: embedded frontend assets
- Updated existing storage, secrets, config to match new model structure

internal/secrets/redact.go

@@ -0,0 +1,37 @@
+// Package secrets provides encrypted credential storage and redaction utilities.
+package secrets
+
+import "strings"
+
+// RedactSecret replaces a secret string with a redacted placeholder.
+// Used for logging and UI display to prevent accidental secret exposure.
+func RedactSecret(s string) string {
+	if len(s) == 0 {
+		return ""
+	}
+	return "••••••••"
+}
+
+// RedactInString replaces all occurrences of a secret within a larger string
+// with a redacted placeholder. This is useful for sanitising log output that
+// may inadvertently contain sensitive material.
+func RedactInString(text, secret string) string {
+	if secret == "" {
+		return text
+	}
+	return strings.ReplaceAll(text, secret, "••••••••")
+}
+
+// RedactMap returns a shallow copy of the map with every value replaced by
+// a redacted placeholder. The original map is not modified.
+func RedactMap(m map[string]string) map[string]string {
+	redacted := make(map[string]string, len(m))
+	for k, v := range m {
+		if v == "" {
+			redacted[k] = ""
+		} else {
+			redacted[k] = "••••••••"
+		}
+	}
+	return redacted
+}