Fix tab close modal, section headers, and credential storage

Tab close confirmation:
- Add is-visible to both backdrop AND modal element — the modal CSS
  starts with visibility:hidden/opacity:0, so the modal was invisible
  despite the backdrop blur appearing

Section headers (sidebar + profile editor):
- Add mousedown preventDefault() on all clickable section headers —
  WKWebView initiates a text selection gesture on mousedown for divs,
  swallowing the first click and requiring a double-click
- Fix sidebar delete profile to use custom modal instead of blocked
  window.confirm()

Credential storage:
- buildSecretCallback now respects profile's secretMode field:
  - 'saved': checks keychain/vault first, prompts if missing, then
    persists to keychain (preferred) or encrypted vault
  - 'session-only': caches in memory per-session, prompts once
  - 'ask-every-time': always prompts
- Previously the callback always prompted and never saved
- Change default secretMode from 'ask-every-time' to 'saved' in both
  Go defaults and JS frontend defaults

frontend/src/js/profiles.js

@@ -16,8 +16,8 @@ const DEFAULTS = {
         protocol: 'ssh',
         ssh: {
             authMethods: ['publickey', 'password', 'keyboard-interactive'],
-            secretMode: 'ask-every-time',
-            keySecretMode: 'ask-every-time',
+            secretMode: 'saved',
+            keySecretMode: 'saved',
             hostKeyPolicy: 'ask',
             terminalType: 'xterm-256color',
             keepaliveInterval: 30,
@@ -459,6 +459,9 @@ class ProfileEditor {
             }
         }
 
+        // Prevent mousedown from starting a text selection gesture in WKWebView,
+        // which would swallow the first click and require a double-click.
+        header.addEventListener('mousedown', (e) => e.preventDefault());
         header.addEventListener('click', () => {
             collapsed = !collapsed;
             content.style.display = collapsed ? 'none' : 'block';