Add secrets, SSH keys, and Tailscale support
Introduce secrets, SSH keys and Tailscale auth key APIs and types.
Implement client-side sealed-box encryption (Pocketenv.Crypto) using
X25519 + NaCl (kcl) with base64url output. Add redaction for private
keys and auth keys and validate Tailscale key prefix. Add kcl
dependency.