TUI: improve store secret configuration

[rmanibus]

Summary

• align the TUI store modal more closely with the CLI store configuration model
• add nested secret-reference configuration so secret fields can save to env refs or writable backends like keychain
• remove recovery from the normal store form and keep secret editing explicit with 'e'

Part of #232

Verification

• env GOCACHE=/tmp/cloudstic-gocache go test -count=1 ./cmd/cloudstic ./internal/app ./internal/tui
• env GOCACHE=/tmp/cloudstic-gocache GOLANGCI_LINT_CACHE=/tmp/cloudstic-golangci-lint golangci-lint run ./cmd/cloudstic ./internal/app ./internal/tui

[codecov]

Codecov Report

❌ Patch coverage is 54.86726% with 204 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/cloudstic/cmd_tui_store_form.go	58.07%	158 Missing and 21 partials ⚠️
cmd/cloudstic/cmd_tui_profile_form.go	0.00%	24 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!