Secrets: pick, create, and find keys without leaving the flow

Working with API keys got a full pass.

• Pick instead of typing. Fields that take a {{secret:NAME}} reference (MCP auth headers, tool connections) now offer a picker over your stored secrets, showing names and masked previews only, with an inline create dialog when the key doesn't exist yet.
• "Get key" everywhere. Secrets can carry a docsUrl pointing at the provider's key console, and a curated registry covers 15 common providers (OpenAI, Anthropic, Stripe, Slack, GitHub, and more) so the link appears automatically as you type a recognized key name. The create and rotate dialogs now match the intake screen.
• A mask that always masks. Secret value inputs fall back to a standard password field in browsers that don't support CSS text masking, where pasted values previously rendered as plain text.
• Products show their real keys. Product setup and configuration now derive required secrets from the live {{secret:KEY}} references across the product's agents, flows, and tools, not just from declared bindings. Products assembled from individually created tools and agents used to show "All keys ready" while their keys sat unconfigured; they now list every referenced key, including products created before this change.