feat: auto-detect encrypted files + CLI --password flag

- Storage.IsDataEncrypted() checks if hosts.json is encrypted
- TUI auto-detects encrypted files, prompts password automatically
- Root command: --password flag for all CLI commands
- newStorage() helper applies password flag to storage
- add/list/edit/delete commands now support encrypted storage
- passwordSetMsg loads hosts after password is set

pkg/tui/tui.go

@@ -117,9 +117,28 @@ func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		return m, cmd
 
 	case passwordSetMsg:
-		// Password was set — store it and proceed to host list
+		// Password was set — store it and load hosts
 		m.storagePassword = msg.password
-		// Close the password prompt tab, host list should already be there
+
+		// Load hosts with the password
+		store, err := storage.NewJSONStorage(m.dataDir)
+		if err == nil {
+			store.SetPassword(msg.password)
+			ctx := context.Background()
+			hosts, loadErr := store.ListHosts(ctx)
+			if loadErr == nil {
+				m.Hosts = hosts
+				// Update host list tab if it exists
+				if hl, ok := m.tabs.Active().(*HostListTab); ok {
+					hl.SetHosts(hosts)
+				}
+			}
+		}
+
+		// Close the password prompt tab
+		if m.tabs.Len() > 1 {
+			m.tabs.CloseActive()
+		}
 		return m, nil
 
 	case openEncryptPromptMsg: