feat: encryption password prompt + --encrypt flag

- PasswordPromptTab: setup/unlock modes, password + confirm fields
- --encrypt flag: shows password prompt on TUI startup
- Model.ShowEncryptPrompt() triggers prompt on first render
- passwordSetMsg stores password in Model.storagePassword
- Tab interface: added Close() method to PasswordPromptTab

pkg/tui/tui.go

@@ -31,8 +31,9 @@ type Model struct {
 	program       *tea.Program
 
 	// Security
-	storagePassword string
-	knownHosts      *knownhosts.KnownHosts
+	storagePassword    string
+	knownHosts         *knownhosts.KnownHosts
+	showEncryptPrompt  bool
 }
 
 // New creates a new TUI model
@@ -50,6 +51,15 @@ func New() *Model {
 
 // Init initializes the TUI
 func (m *Model) Init() tea.Cmd {
+	if m.showEncryptPrompt {
+		// Show password prompt tab
+		tab := NewPasswordPromptTab(passwordModeSetup, m.dataDir, func(password string) {
+			m.storagePassword = password
+		})
+		cmd := m.tabs.Add(tab)
+		m.showEncryptPrompt = false
+		return cmd
+	}
 	return m.tabs.Init()
 }
 
@@ -68,6 +78,11 @@ func (m *Model) SetKnownHosts(kh *knownhosts.KnownHosts) {
 	m.knownHosts = kh
 }
 
+// ShowEncryptPrompt sets a flag to show the encryption setup prompt on first render
+func (m *Model) ShowEncryptPrompt() {
+	m.showEncryptPrompt = true
+}
+
 // Update handles messages and updates the model
 func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	switch msg := msg.(type) {
@@ -101,6 +116,20 @@ func (m *Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		cmd := m.tabs.Add(tab)
 		return m, cmd
 
+	case passwordSetMsg:
+		// Password was set — store it and proceed to host list
+		m.storagePassword = msg.password
+		// Close the password prompt tab, host list should already be there
+		return m, nil
+
+	case openEncryptPromptMsg:
+		// Show password setup prompt
+		tab := NewPasswordPromptTab(passwordModeSetup, m.dataDir, func(password string) {
+			m.storagePassword = password
+		})
+		cmd := m.tabs.Add(tab)
+		return m, cmd
+
 	case openSFTPMsg:
 		tab := NewSFTPBrowserTab(msg.host, m.dataDir)
 		if m.program != nil {