feat: auto-detect encrypted files + CLI --password flag

- Storage.IsDataEncrypted() checks if hosts.json is encrypted
- TUI auto-detects encrypted files, prompts password automatically
- Root command: --password flag for all CLI commands
- newStorage() helper applies password flag to storage
- add/list/edit/delete commands now support encrypted storage
- passwordSetMsg loads hosts after password is set

cmd/hostkeeper/root.go

@@ -7,13 +7,15 @@ import (
 	"github.com/spf13/viper"
 
 	"git.tukangketik.id/swanadiva/hostkeeper/pkg/config"
+	"git.tukangketik.id/swanadiva/hostkeeper/pkg/storage"
 )
 
 var (
-	cfgFile string
-	appCfg  *config.Config
-	verbose int
-	debug   bool
+	cfgFile        string
+	appCfg         *config.Config
+	verbose        int
+	debug          bool
+	passwordFlag   string
 )
 
 var rootCmd = &cobra.Command{
@@ -47,6 +49,7 @@ func init() {
 	rootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is platform-specific app dir)")
 	rootCmd.PersistentFlags().CountVarP(&verbose, "verbose", "v", "verbose output (-v for info, -vv for debug)")
 	rootCmd.PersistentFlags().BoolVar(&debug, "debug", false, "enable debug mode")
+	rootCmd.PersistentFlags().StringVar(&passwordFlag, "password", "", "master password for encrypted storage")
 
 	rootCmd.AddCommand(versionCmd)
 }
@@ -84,4 +87,16 @@ var versionCmd = &cobra.Command{
 // Execute runs the root command
 func Execute() error {
 	return rootCmd.Execute()
+}
+
+// newStorage creates a new JSONStorage with the password flag applied
+func newStorage(cfg *config.Config) (*storage.JSONStorage, error) {
+	store, err := storage.NewJSONStorage(cfg.GetDataDir())
+	if err != nil {
+		return nil, err
+	}
+	if passwordFlag != "" {
+		store.SetPassword(passwordFlag)
+	}
+	return store, nil
 }