fix: proxy passwords and TOTP seeds live only in the secret store

SshConfig no longer has proxyPassword or totpSecret fields, so neither
can sit in clear in nexus.db or travel in an export. The proxy password
is a SecretKind (profile:<id>:proxy-password) edited like other saved
credentials and purged with the profile; the session manager hands both
it and the TOTP seed to the SSH client from the keychain/vault at
connect time.

This drops compatibility with Go-era profiles and .link/.nexus files
that carry these values inline: they are ignored on read and must be
re-entered (SEC-20261012-011).

rust/app/src/profile_editor.rs

@@ -551,8 +551,7 @@ impl ProfileEditor {
                 text(ui, "Proxy Host", &mut c.proxy_host, "proxy.example.com");
                 num(ui, "Proxy Port", &mut c.proxy_port, 1..=65535);
                 text(ui, "Proxy Username", &mut c.proxy_username, "Optional");
-                label(ui, "Proxy Password");
-                ui.add(TextEdit::singleline(&mut c.proxy_password).password(true).hint_text("Optional").desired_width(f32::INFINITY));
+                secret(ui, "Proxy Password", secrets, SecretKind::ProxyPassword, "Optional; leave blank to keep the saved password");
             }
         });
         section(ui, "Advanced", |ui| {