fix: proxy passwords and TOTP seeds live only in the secret store

SshConfig no longer has proxyPassword or totpSecret fields, so neither
can sit in clear in nexus.db or travel in an export. The proxy password
is a SecretKind (profile:<id>:proxy-password) edited like other saved
credentials and purged with the profile; the session manager hands both
it and the TOTP seed to the SSH client from the keychain/vault at
connect time.

This drops compatibility with Go-era profiles and .link/.nexus files
that carry these values inline: they are ignored on read and must be
re-entered (SEC-20261012-011).

rust/core/src/secrets.rs

@@ -30,12 +30,13 @@ pub enum SecretKind {
     IrcNickServPassword,
     IrcSshPassword,
     IrcSshPassphrase,
+    ProxyPassword,
 }
 
 impl SecretKind {
     /// Every kind, so deleting a profile can purge them all from the keychain. A new variant
     /// must be added here as well as to `as_str`.
-    pub const ALL: [SecretKind; 11] = [
+    pub const ALL: [SecretKind; 12] = [
         Self::Password,
         Self::Passphrase,
         Self::Totp,
@@ -47,6 +48,7 @@ impl SecretKind {
         Self::IrcNickServPassword,
         Self::IrcSshPassword,
         Self::IrcSshPassphrase,
+        Self::ProxyPassword,
     ];
 
     /// The storage name, shared with the Go app.
@@ -63,6 +65,7 @@ impl SecretKind {
             Self::IrcNickServPassword => "irc-nickserv-password",
             Self::IrcSshPassword => "irc-ssh-password",
             Self::IrcSshPassphrase => "irc-ssh-passphrase",
+            Self::ProxyPassword => "proxy-password",
         }
     }