Envault maintenance: require explicit decline in secret request window

[MildyNora]

Entering a secret beginning with n in the request window switched to decline mode and could send the remaining characters back to the agent as a note. Declining now requires F2, so every printable character stays in the masked secret field. The footer shows the new shortcut; Enter and Esc retain their existing behavior.

Regression coverage exercises exact granting of n-prefixed values, n after clearing input, decline with and without a note, declining after partial secret entry, cancellation, masked rendering, encrypted storage, and agent-facing result contents.

Validation completed in the Linux cloud environment:

• 92 unit tests and 22 integration tests passed.
• Seven actual request-window PTY probes passed after reproducing the original issue.
• Formatting, clippy, and diff whitespace checks passed.
• Test/clippy commands used the command-only Cargo option --config 'profile.dev.package.zbus.codegen-units=1' to work around a cloud compiler dependency-archive error. Repository build settings and release authentication are unchanged.

All fixtures used synthetic secrets and isolated debug identity files. Native keychain/biometric prompts and desktop function-key delivery still need hardware validation. The published files match the cloud-validated patch exactly; GitHub CI will validate the branch independently.

Maintenance record: this is the first focused maintenance item. Implementation and cloud validation are complete; continue this PR for CI or review feedback. Next item after this is resolved: sanitize malformed dotenv import errors. Existing review snapshot PRs #2 and #3 are separate from this maintenance queue.