feat: add secure credential management TUI

[ttys3]

Summary

• add a Bubble Tea/Bubbles TUI for listing, adding, editing, and deleting Git credentials through validated structured fields
• add opt-in native storage through macOS Keychain, Linux/BSD Secret Service, and Windows Credential Manager while retaining the credential-store-compatible file backend
• harden credential updates with secret-redacted UI, verified keyring metadata, atomic writes, concurrent-change detection, and deferred keyring cleanup

Compatibility

• keep file as the default lookup backend and preserve store/erase as no-ops
• add explicit keyring and auto lookup backends
• preserve Git credential-store URL formatting, symlink behavior, and Git-compatible .lock updates
• require Go 1.25 for Bubble Tea v2 while CI remains on Go 1.27.1

Testing

• go test ./...
• go test -race ./...
• go test -shuffle=on -count=20 ./...
• CGO_ENABLED=0 go test ./...
• go vet ./...
• staticcheck ./...
• govulncheck ./...
• cross-compiled test binaries for Linux, macOS, Windows, FreeBSD, and OpenBSD
• verified bidirectional interoperability with Git's built-in credential-store
• exercised the TUI in a real PTY and scanned the committed snapshot with Gitleaks

Git references

• Credential helper configuration and credential.useHttpPath
• git-credential-store storage format
• Git's atomic lockfile protocol