feat: encryption password prompt + --encrypt flag

- PasswordPromptTab: setup/unlock modes, password + confirm fields
- --encrypt flag: shows password prompt on TUI startup
- Model.ShowEncryptPrompt() triggers prompt on first render
- passwordSetMsg stores password in Model.storagePassword
- Tab interface: added Close() method to PasswordPromptTab

cmd/hostkeeper/tui.go

@@ -13,6 +13,8 @@ import (
 	"git.tukangketik.id/swanadiva/hostkeeper/pkg/tui"
 )
 
+var encryptFlag bool
+
 // tuiCmd represents the tui command
 var tuiCmd = &cobra.Command{
 	Use:   "tui",
@@ -23,6 +25,7 @@ var tuiCmd = &cobra.Command{
 
 func init() {
 	rootCmd.AddCommand(tuiCmd)
+	tuiCmd.Flags().BoolVar(&encryptFlag, "encrypt", false, "Enable AES-256-GCM encryption for sensitive data")
 }
 
 func runTUI(cmd *cobra.Command, args []string) error {
@@ -59,6 +62,11 @@ func runTUI(cmd *cobra.Command, args []string) error {
 		model.SetKnownHosts(kh)
 	}
 
+	// If --encrypt flag, show password prompt first
+	if encryptFlag {
+		model.ShowEncryptPrompt()
+	}
+
 	p := tea.NewProgram(model)
 	model.SetProgram(p)
 	if _, err := p.Run(); err != nil {