feat(cli): add codex secrets commands (#10551)

## Summary

Builds on PR B’s core secrets config wiring by adding a user-facing CLI:

- `codex secrets set`
- `codex secrets edit`
- `codex secrets list`
- `codex secrets delete`

Uses `Config.secrets_backend` and supports scopes:

- `--global`
- `--env <id>`
- default env scope from cwd

Values can be provided via `--value`, stdin, or interactive masked
prompt.

## Notes

- `list` never prints secret values
- `edit` errors if secret is missing
- `delete` is no-op if missing

codex-rs/cli/Cargo.toml

@@ -36,6 +36,7 @@ codex-responses-api-proxy = { workspace = true }
 codex-rmcp-client = { workspace = true }
 codex-stdio-to-uds = { workspace = true }
 codex-tui = { workspace = true }
+crossterm = { workspace = true }
 libc = { workspace = true }
 owo-colors = { workspace = true }
 regex-lite = { workspace = true }
@@ -58,6 +59,7 @@ codex_windows_sandbox = { package = "codex-windows-sandbox", path = "../windows-
 [dev-dependencies]
 assert_cmd = { workspace = true }
 assert_matches = { workspace = true }
+codex-keyring-store = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 predicates = { workspace = true }
 pretty_assertions = { workspace = true }