fix: forget saved credentials when a synced/imported profile is retargeted; --answer needs --screenshot

- Saved credentials are keyed by profile id. A sync peer (or a crafted
  import using 'overwrite') could keep an existing profile's id but point
  it at another host, user, GitHub API URL, RD Gateway or jump host, and
  the saved password/token went there on the next connect without a
  prompt. Such a change now forgets that profile's saved credentials
  (audited), so the user is asked again.
- --answer / NEXUS_ANSWERS auto-fill every credential prompt and --answer
  is visible in the process list; they're now refused unless --screenshot
  is given (they exist for screenshot automation).
- Docs: IRC passwords are only sent over TLS/tunnel/loopback; sync's
  retarget behaviour; the --answer restriction.

rust/core/tests/sync.rs

@@ -29,6 +29,8 @@ fn profiles_follow_edits_and_deletes_across_machines() {
     p.host = "web.example".into();
     p.username = "me".into();
     let p = a.create_profile(p).unwrap();
+    let pw_key = nexus_core::secrets::SecretKind::Password.key(&p.id);
+    a.secrets.set_checked(&pw_key, "hunter2").unwrap();
     assert!(a.sync_profiles().unwrap().pushed);
     assert_eq!(b.sync_profiles().unwrap().pulled, 1);
     assert_eq!(b.profiles()[0].host, "web.example");
@@ -40,6 +42,9 @@ fn profiles_follow_edits_and_deletes_across_machines() {
     b.sync_profiles().unwrap();
     assert_eq!(a.sync_profiles().unwrap().pulled, 1);
     assert_eq!(a.profiles()[0].host, "web2.example");
+    // A's saved password was for web.example; the synced copy points elsewhere, so it's forgotten
+    // rather than sent to the new host without asking.
+    assert!(a.secrets.get(&pw_key).is_none());
 
     a.delete_profile(&p.id).unwrap();
     a.sync_profiles().unwrap();