fix: proxy passwords and TOTP seeds live only in the secret store

SshConfig no longer has proxyPassword or totpSecret fields, so neither
can sit in clear in nexus.db or travel in an export. The proxy password
is a SecretKind (profile:<id>:proxy-password) edited like other saved
credentials and purged with the profile; the session manager hands both
it and the TOTP seed to the SSH client from the keychain/vault at
connect time.

This drops compatibility with Go-era profiles and .link/.nexus files
that carry these values inline: they are ignored on read and must be
re-entered (SEC-20261012-011).

rust/core/src/models.rs

@@ -262,13 +262,10 @@ pub struct SshConfig {
     pub max_reconnect_tries: i64,
     #[serde(deserialize_with = "nd")]
     pub login_scripts: Vec<LoginScriptStep>,
-    #[serde(rename = "totpSecret")]
-    pub totp_secret: String,
     pub proxy_type: String,
     pub proxy_host: String,
     pub proxy_port: i64,
     pub proxy_username: String,
-    pub proxy_password: String,
     #[serde(deserialize_with = "nd")]
     pub jump_hosts: Vec<JumpHost>,
     #[serde(deserialize_with = "nd")]
@@ -937,6 +934,13 @@ impl IrcConfig {
 mod tests {
     use super::*;
 
+    #[test]
+    fn profiles_never_carry_proxy_passwords_or_totp_seeds() {
+        let c: SshConfig = serde_json::from_str(r#"{"proxyPassword":"p","totpSecret":"JBSWY3DPEHPK3PXP","proxyUsername":"u"}"#).unwrap();
+        let out = serde_json::to_string(&c).unwrap();
+        assert!(!out.contains("proxyPassword") && !out.contains("totpSecret") && out.contains("\"proxyUsername\":\"u\""), "{out}");
+    }
+
     #[test]
     fn unknown_enum_values_fall_back_per_field() {
         let c: SshConfig = serde_json::from_str(r#"{"hostKeyPolicy":"from-the-future","keepaliveInterval":42,"agentForwarding":true}"#).unwrap();