[feature] panel: key vault add/remove — masked secret entry, delete with confirm

[YJack0000]

What

The panel's key vault view could only display keys and pointed at the CLI for everything else. It now manages them:

• Add key — drawer form with a masked secret field (id, provider, label + optional purpose/scopes/expires/endpoint, overwrite-as-rotation). The secret exists in the input, the invoke payload, and KeyRegistry::add — nowhere else; the field is cleared on submit and on failure.
• Delete — per-row trash with an inline confirm that says what deletion means: the entry and its keychain value go, the credential keeps working until revoked at the provider.
• Empty state offers the button and keeps the pb key add one-liner.

Why relaxing "the panel never takes a secret" is sound

The CLI-only rule existed because argv leaks into ps and shell history. Neither applies to a masked field in a native window handing the value straight to the same KeyRegistry::add. The line that actually matters is unchanged: the panel still never reads a value back — no reveal, no copy, get_secret stays unwired; pb key copy remains the only exit. docs/key-vault.md documents the split rationale.

Also: app/src-tauri now pins itself as a standalone cargo workspace, fixing builds from nested git worktrees (cargo walked up to the outer checkout's root and refused).

Verification

bun run build (tsc + vite) green; cargo check in src-tauri green from a nested worktree; clippy -D warnings clean on the Rust side; core registry behavior covered by patchbay-core's existing 28 vault tests (the panel adds no validation of its own — registry errors surface verbatim).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud