test: Phase 3 comprehensive test coverage — 105 tests, zero race conditions

- Add test/crypto/ (19 tests): AES-256-GCM encrypt/decrypt, PBKDF2, IsEncrypted, HashPassword
- Add test/knownhosts/ (14 tests): TOFU verify, MITM detection, CRUD, persistence
- Add test/storage/ (20 tests): KeyPair/Snippet CRUD, encryption, MergeStrategy
- Add test/config/ (9 tests): config lifecycle, path getters
- Add test/tui/ (10 tests): WrapFooter, ClampWidth, TruncateStr
- Fix knownhosts deadlock: Add/Remove use saveInternal()
- Export responsive.go functions for testing
- Add docs/TEST_PLAN.md with full scenario documentation

Coverage: crypto 0%→100%, knownhosts 0%→100%, storage 40%→90%, config 22%→80%, tui 40%→70%

pkg/tui/responsive.go

@@ -106,3 +106,20 @@ func truncateStr(s string, maxLen int) string {
 	}
 	return string(result) + "…"
 }
+
+// Exported wrappers for testing
+
+// WrapFooter wraps a footer string into multiple lines that fit availW
+func WrapFooter(text string, availW int) string {
+	return wrapFooter(text, availW)
+}
+
+// ClampWidth clamps a target box width to fit within the terminal
+func ClampWidth(target, termWidth int) int {
+	return clampWidth(target, termWidth)
+}
+
+// TruncateStr truncates a string to maxLen with an ellipsis character
+func TruncateStr(s string, maxLen int) string {
+	return truncateStr(s, maxLen)
+}