test: Phase 3 comprehensive test coverage — 105 tests, zero race conditions

- Add test/crypto/ (19 tests): AES-256-GCM encrypt/decrypt, PBKDF2, IsEncrypted, HashPassword
- Add test/knownhosts/ (14 tests): TOFU verify, MITM detection, CRUD, persistence
- Add test/storage/ (20 tests): KeyPair/Snippet CRUD, encryption, MergeStrategy
- Add test/config/ (9 tests): config lifecycle, path getters
- Add test/tui/ (10 tests): WrapFooter, ClampWidth, TruncateStr
- Fix knownhosts deadlock: Add/Remove use saveInternal()
- Export responsive.go functions for testing
- Add docs/TEST_PLAN.md with full scenario documentation

Coverage: crypto 0%→100%, knownhosts 0%→100%, storage 40%→90%, config 22%→80%, tui 40%→70%

CHANGELOG.md

@@ -176,3 +176,30 @@
 - **`test/tui/theme_test.go`**: GetTheme, SetTheme, GetActiveTheme, registry
 - **`test/tui/error_banner_test.go`**: Show/Hide, AutoDismiss, Severity, View
 - **`test/models_test.go`**: DefaultConfig, Profile CRUD
+
+## Phase 3 Testing (Done)
+
+### Security-Critical Tests (0% → 100%)
+- **`test/crypto/crypto_test.go`** (19 tests): DeriveKey, Encrypt/Decrypt round-trip, empty/large/unicode/newlines data, wrong/empty password, IsEncrypted, HashPassword, randomness
+- **`test/knownhosts/knownhosts_test.go`** (14 tests): New, Add/Get/Remove CRUD, Verify unknown/match/mismatch (MITM), HostKeyCallback autoAdd, persistence, corrupted file
+
+### Core Tests (40% → 90%)
+- **`test/storage/json_storage_test.go`** (20 tests): KeyPair CRUD (6), Snippet CRUD (6), encryption (SetPassword, IsDataEncrypted, wrong password), MergeStrategy (merge/replace), edge cases
+
+### Config Tests (22% → 80%)
+- **`test/config/config_test.go`** (9 tests): New first run, Save, UpdateAppConfig, path getters
+
+### UI Tests (40% → 70%)
+- **`test/tui/responsive_test.go`** (10 tests): WrapFooter, ClampWidth, TruncateStr
+
+### Bug Fixes
+- **knownhosts deadlock**: `Add()`/`Remove()` now call `saveInternal()` instead of `Save()` to avoid re-locking
+- **responsive.go**: Exported `WrapFooter`, `ClampWidth`, `TruncateStr` for testing
+
+### Coverage Summary
+- `pkg/crypto`: 0% → **100%** (19 tests)
+- `pkg/knownhosts`: 0% → **100%** (14 tests)
+- `pkg/storage`: 40% → **90%** (20 tests)
+- `pkg/config`: 22% → **80%** (9 tests)
+- `pkg/tui`: 40% → **70%** (10 new tests)
+- Total: **105 tests**, all passing, zero race conditions