Add reveal-secret-key after unlock (CLI + GUI)

- profiles::reveal_secret_key returns a key in hex and nsec1... forms, gated on
  an unlocked vault (VaultLocked when encrypted + locked)
- IPC: reveal_secret_key method; error replies now carry a machine-readable
  code field (ErrorKind as snake_case, e.g. vault_locked)
- CLI: show-secret <npub> prompts for the vault password when locked
- GUI: 'Secret key' button per profile card opens a modal showing hex + nsec
  with copy buttons; locked vaults ask for the password inline before revealing
- Tests: Rust (reveal plaintext/encrypted/locked) and Vitest (reveal flow,
  lock-then-unlock), all green

README.md

@@ -17,6 +17,8 @@ runs in the Rust backend, which the GUI talks to over a JSON-lines IPC channel.
 - Password-protected vault: secret keys are encrypted at rest with AES-256-GCM under an
   Argon2id-derived key. Without a password set, the vault is stored in plaintext (readable only by
   your user account) and this is disclosed in the app
+- Reveal a profile's secret key (hex + `nsec1...`) from the app or the CLI — only after the vault
+  password is entered, so keys stay encrypted at rest
 
 ## Architecture
 
@@ -92,13 +94,15 @@ cargo run --release -- settings get|set theme|confirm|shorten
 cargo run --release -- set-password              # encrypt the vault (or change its password)
 cargo run --release -- remove-password           # remove vault encryption
 cargo run --release -- unlock                    # verify the vault password for this process
+cargo run --release -- show-secret <npub>        # reveal a profile's secret key (hex + nsec)
 cargo run --release -- info                      # show storage locations and version
 cargo run --release -- serve                     # JSON-lines IPC server (used by the GUI)
 ```
 
 Passwords are read from the `NFM_PASSWORD` environment variable when set, otherwise you are
 prompted interactively. They are never accepted as command-line arguments. `create` and `publish`
-prompt for the vault password automatically when the vault is encrypted.
+prompt for the vault password automatically when the vault is encrypted, and so does `show-secret` —
+the key is only displayed after the vault password is entered.
 
 ## Storage and migration