feat: auto-detect encrypted files + CLI --password flag

- Storage.IsDataEncrypted() checks if hosts.json is encrypted
- TUI auto-detects encrypted files, prompts password automatically
- Root command: --password flag for all CLI commands
- newStorage() helper applies password flag to storage
- add/list/edit/delete commands now support encrypted storage
- passwordSetMsg loads hosts after password is set

pkg/storage/json_storage.go

@@ -52,6 +52,16 @@ func (s *JSONStorage) IsEncrypted() bool {
 	return s.password != ""
 }
 
+// IsDataEncrypted checks if the data files are actually encrypted
+func (s *JSONStorage) IsDataEncrypted() bool {
+	path := filepath.Join(s.dataDir, "hosts.json")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false
+	}
+	return crypto.IsEncrypted(string(data))
+}
+
 func (s *JSONStorage) ensureDataFiles() error {
 	files := map[string]string{
 		"hosts.json":    "hosts",