Fix tab close modal, section headers, and credential storage

Tab close confirmation:
- Add is-visible to both backdrop AND modal element — the modal CSS
  starts with visibility:hidden/opacity:0, so the modal was invisible
  despite the backdrop blur appearing

Section headers (sidebar + profile editor):
- Add mousedown preventDefault() on all clickable section headers —
  WKWebView initiates a text selection gesture on mousedown for divs,
  swallowing the first click and requiring a double-click
- Fix sidebar delete profile to use custom modal instead of blocked
  window.confirm()

Credential storage:
- buildSecretCallback now respects profile's secretMode field:
  - 'saved': checks keychain/vault first, prompts if missing, then
    persists to keychain (preferred) or encrypted vault
  - 'session-only': caches in memory per-session, prompts once
  - 'ask-every-time': always prompts
- Previously the callback always prompted and never saved
- Change default secretMode from 'ask-every-time' to 'saved' in both
  Go defaults and JS frontend defaults

internal/models/defaults.go

@@ -72,8 +72,8 @@ func NewProfile(protocol Protocol) Profile {
 		p.Port = DefaultSSHPort
 		p.SSH = &SSHConfig{
 			AuthMethods:       []string{"publickey", "password", "keyboard-interactive"},
-			SecretMode:        SecretModeAskEveryTime,
-			KeySecretMode:     SecretModeAskEveryTime,
+			SecretMode:        SecretModeSaved,
+			KeySecretMode:     SecretModeSaved,
 			HostKeyPolicy:     HostKeyAsk,
 			TerminalType:      DefaultTerminalType,
 			KeepaliveInterval: DefaultKeepaliveInterval,