feat(secret): add secret get and secret set, and show key names in ls

[anak10thn]

Problem

Two gaps, and they made each other worse.

You could not see what a Secret holds. secret ls showed a key count and nothing else — not even the names — and there was no secret get. orcinus config --show-secrets does not cover it either: it selects on managed-by and orcinus.io/project, and a Secret made by secret create has no project label, so it never appears there. Reading a value meant:

orcinus kubectl get secret app-secret -o jsonpath='{.data.DB_PASS}' | base64 -d

Updating one key destroyed the others. secret create on an existing name replaces the whole object:

orcinus secret create app-secret --from-literal DB_PASS=xxx --from-literal API_KEY=yyy
orcinus secret create app-secret --from-literal DB_PASS=new
# → API_KEY gone, no warning

And since the keys could not be listed, there was no way to know what to re-pass.

Change

$ orcinus secret get app-secret
Name:                 app-secret
Type:                 Opaque
Managed by orcinus:   true

KEY       VALUE
API_KEY   <12 bytes, hidden>
DB_PASS   <8 bytes, hidden>

Values hidden. Re-run with --show-values to print them.

$ orcinus secret set app-secret --from-literal DB_PASS=new
secret "app-secret" updated: set DB_PASS (2 key(s) total)
         running pods keep the old values until restarted (`orcinus restart <service>`)

• secret get — keys listed, values withheld unless --show-values, so it is safe in a shared terminal.
• secret set — merges; keys not named are kept, and the Secret is created if absent. It preserves the Secret's existing type, so merging into a TLS or dockerconfigjson Secret does not retype it to Opaque and break every consumer (tested).
• secret ls — key names instead of a bare count, truncated to three with +N more.
• secret create — keeps replace semantics, since that is what it means, but now names the keys it dropped and points at set.

Both writers reject an empty --from-literal set rather than clearing a Secret.

The two things that bite, now in --help

• create REPLACES — stated in its long help
• a changed Secret does not reach running pods: env vars are injected at container start, so orcinus restart <service> is needed. Secrets consumed as a mounted file (external: true) are the exception — the kubelet refreshes those in place.

Tests

10 new, 147 total.

pkg/deploy against a fake clientset: merge keeps untouched keys; merge creates when absent; merge preserves an existing TLS type; GetSecret sorts keys and reports ManagedBy; ListSecrets returns names. Plus TestApplySecretReplaces, which pins the destructive behaviour set exists to avoid, so it cannot drift silently.

pkg/cli: subcommands resolve with the expected flag defaults, --show-values defaults to false, the help text keeps its two warnings, parseLiterals edge cases (K=, WITH=a=b, rejects NOEQUALS and =novalue), and summarizeKeys truncation.

Note for reviewers

GET /api/v1/secrets gains a KeyNames field, since it serializes the shared ListSecrets type — names only, no values. The API's POST keeps replace semantics; only the CLI grew a merge path. Say the word if the API should get set too.