feat: auto-detect encrypted files + CLI --password flag

- Storage.IsDataEncrypted() checks if hosts.json is encrypted
- TUI auto-detects encrypted files, prompts password automatically
- Root command: --password flag for all CLI commands
- newStorage() helper applies password flag to storage
- add/list/edit/delete commands now support encrypted storage
- passwordSetMsg loads hosts after password is set

pkg/storage/json_storage.go

@@ -52,6 +52,16 @@ func (s *JSONStorage) IsEncrypted() bool {
 	return s.password != ""
 }
 
+// IsDataEncrypted checks if the data files are actually encrypted
+func (s *JSONStorage) IsDataEncrypted() bool {
+	path := filepath.Join(s.dataDir, "hosts.json")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	return crypto.IsEncrypted(string(data))
+}
+
 func (s *JSONStorage) ensureDataFiles() error {
 	files := map[string]string{
 		"hosts.json":    "hosts",

pkg/tui/tui.go

@@ -117,9 +117,28 @@ func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, cmd
 
 	case passwordSetMsg:
-		// Password was set — store it and proceed to host list
+		// Password was set — store it and load hosts
 		m.storagePassword = msg.password
-		// Close the password prompt tab, host list should already be there
+
+		// Load hosts with the password
+		store, err := storage.NewJSONStorage(m.dataDir)
+		if err == nil {
+			store.SetPassword(msg.password)
+			ctx := context.Background()
+			hosts, loadErr := store.ListHosts(ctx)
+			if loadErr == nil {
+				m.Hosts = hosts
+				// Update host list tab if it exists
+				if hl, ok := m.tabs.Active().(*HostListTab); ok {
+					hl.SetHosts(hosts)
+				}
+			}
+		}
+
+		// Close the password prompt tab
+		if m.tabs.Len() > 1 {
+			m.tabs.CloseActive()
+		}
 		return m, nil
 
 	case openEncryptPromptMsg: