feat: auto-detect encrypted files + CLI --password flag

- Storage.IsDataEncrypted() checks if hosts.json is encrypted
- TUI auto-detects encrypted files, prompts password automatically
- Root command: --password flag for all CLI commands
- newStorage() helper applies password flag to storage
- add/list/edit/delete commands now support encrypted storage
- passwordSetMsg loads hosts after password is set

cmd/hostkeeper/tui.go

@@ -49,22 +49,26 @@ func runTUI(cmd *cobra.Command, args []string) error {
 		fmt.Printf("Warning: failed to load known_hosts: %v\n", err)
 	}
 
-	ctx := context.Background()
-	hosts, err := store.ListHosts(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to load hosts: %w", err)
-	}
+	// Auto-detect encrypted data files
+	needPassword := encryptFlag || store.IsDataEncrypted()
 
 	model := tui.New()
 	model.SetDataDir(cfg.GetDataDir())
-	model.LoadHosts(hosts)
 	if kh != nil {
 		model.SetKnownHosts(kh)
 	}
 
-	// If --encrypt flag, show password prompt first
-	if encryptFlag {
+	if needPassword {
+		// Show password prompt first — hosts will be loaded after password is set
 		model.ShowEncryptPrompt()
+	} else {
+		// No encryption — load hosts normally
+		ctx := context.Background()
+		hosts, err := store.ListHosts(ctx)
+		if err != nil {
+			return fmt.Errorf("failed to load hosts: %w", err)
+		}
+		model.LoadHosts(hosts)
 	}
 
 	p := tea.NewProgram(model)