feat: integrate security features into TUI

- SFTPBrowserTab: added storagePassword, passphraseCallback fields
- Model: added storagePassword, knownHosts fields
- cmd/hostkeeper/tui.go: initialize known_hosts on startup
- SFTP connect: wire passphrase callback to SSH client
- SetStoragePassword/SetKnownHosts/SetPassphraseCallback methods

pkg/tui/sftp_browser_tab.go

@@ -74,6 +74,10 @@ type SFTPBrowserTab struct {
 
 	program *tea.Program
 
+	// Security
+	storagePassword    string   // master password for encrypted storage
+	passphraseCallback func() string // callback for SSH key passphrases
+
 	mu        sync.Mutex
 	closeOnce sync.Once
 }
@@ -107,6 +111,14 @@ func (t *SFTPBrowserTab) SetProgram(p *tea.Program) {
 	t.program = p
 }
 
+func (t *SFTPBrowserTab) SetStoragePassword(password string) {
+	t.storagePassword = password
+}
+
+func (t *SFTPBrowserTab) SetPassphraseCallback(cb func() string) {
+	t.passphraseCallback = cb
+}
+
 func (t *SFTPBrowserTab) Init() tea.Cmd {
 	go t.connect()
 	go t.refreshLocal()
@@ -132,6 +144,11 @@ func (t *SFTPBrowserTab) connect() {
 	timeout := 30 * time.Second
 	cl := sshclient.NewClient(t.host, timeout)
 
+	// Wire up passphrase callback for encrypted keys
+	if t.passphraseCallback != nil {
+		cl.SetPassphraseCallback(t.passphraseCallback)
+	}
+
 	ctx := context.Background()
 	if err := cl.Connect(ctx); err != nil {
 		t.mu.Lock()