feat: the right pane describes what's selected in the pane you're in (#9)

The right pane kept showing the selected secret when you moved to Vaults or Sources. Now it follows focus:

| focus | right pane |
|---|---|
| Sources | the account (group row), or the subscription / workspace / repo: name, note, ID / profile / path, host or remote, account, web page, vault count |
| Vaults | the vault / scope / file: name, note, URI / backend / format, source, web page, counts of loaded secrets, keys, certificates |
| Secrets | the secret, as before |
| the right pane itself | what it described when you went in; `shift+tab` goes back there |

All but the secret use the `Fields` pane (#7), so `j`/`k`, `/` and `y` work on them; `Detail` loses the error message it got in #4, which is now a red "problem" row in `Fields`. A value revealed from a left pane stays in view until hidden, so `space` from any pane still shows it. `tab` from a subscription goes to Vaults as before; only an account row skips to its details.

This also changes the startup view: focus starts in Sources, so the right pane describes the first subscription instead of the first secret (golden output updated). Tests that read the secret pane focus Secrets first; a new test walks secret → vault → subscription → into the pane → back, and reveals from Sources.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #9

internal/ui/app/app_test.go

@@ -185,8 +185,9 @@ func TestIcons(t *testing.T) {
 	if !strings.Contains(screen, azure+" Azure") || !strings.Contains(screen, dbx+" Databricks") {
 		t.Errorf("icons missing:\n%s", screen)
 	}
-	if !strings.Contains(screen, "source     "+azure+" Azure / platform-prod") {
-		t.Errorf("detail source line missing icon:\n%s", screen)
+	d.keys("3")
+	if !strings.Contains(d.screen(), "source     "+azure+" Azure / platform-prod") {
+		t.Errorf("detail source line missing icon:\n%s", d.screen())
 	}
 }
 
@@ -400,6 +401,7 @@ func (describing) Describe(_ context.Context, o provider.Object) (provider.Objec
 func TestDescribeUpdatesDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t, describing{fake.Azure(0)})
+	d.keys("3") // the fourth pane follows focus: the secret
 	if !strings.Contains(d.screen(), "described  db-password") {
 		t.Fatalf("describe result not shown:\n%s", d.screen())
 	}
@@ -487,6 +489,7 @@ func TestVersions(t *testing.T) {
 func TestVersionHistoryInDetail(t *testing.T) {
 	t.Parallel()
 	d := newDriver(t)
+	d.keys("3") // the fourth pane follows focus: the secret
 	screen := d.screen()
 	for _, want := range []string{
 		"versions   3 · v to browse",
@@ -594,7 +597,7 @@ func TestPermissionErrorShownInPane(t *testing.T) {
 	if !strings.Contains(d.screen(), "403 Forbidden") {
 		t.Error("error not rendered")
 	}
-	if !strings.Contains(d.screen(), "Select a secret") {
+	if !strings.Contains(d.screen(), "name       kv-restricted") {
 		t.Error("detail should show the container summary")
 	}
 }
@@ -1037,7 +1040,7 @@ func TestSignInMessageOnceThenInDetails(t *testing.T) {
 	t.Parallel()
 	d := newDriverOpts(t, Options{CollapseGroups: false}, fake.Azure(0), signedOut{fake.Azure(0)})
 	hint := "Azure · admin: sign-in required"
-	if !strings.Contains(lastLines(d.screen(), 2), hint) {
+	if !strings.Contains(lastLines(d.screen(), 2), hint) { // the footer: one line
 		t.Fatalf("not said at start:\n%s", d.screen())
 	}
 	d.keys("j")
@@ -1050,7 +1053,7 @@ func TestSignInMessageOnceThenInDetails(t *testing.T) {
 	if r, _ := d.m.sources.Selected(); r.provider != "Azure:admin@contoso.com/t1" {
 		t.Fatalf("selected %+v", r)
 	}
-	if !strings.Contains(d.screen(), hint) || !strings.Contains(d.screen(), "press L to run az login --tenant t1") {
+	if scr := d.screen(); !strings.Contains(scr, "problem") || !strings.Contains(scr, hint) || !strings.Contains(scr, "press L to run az login") {
 		t.Errorf("not in Details:\n%s", d.screen())
 	}
 	if a := d.m.loginFor(); a == nil || a.Account != "Azure · admin" {
@@ -1154,3 +1157,35 @@ func TestAccountPane(t *testing.T) {
 		t.Errorf("back to %v, want Sources", d.m.focus)
 	}
 }
+
+func TestDetailsFollowFocus(t *testing.T) {
+	t.Parallel()
+	d := newDriver(t)
+	d.keys("3") // a secret
+	if !strings.Contains(d.screen(), "version    3f9c2a") {
+		t.Fatalf("secret not shown:\n%s", d.screen())
+	}
+	d.keys("2") // its vault
+	if scr := d.screen(); !strings.Contains(scr, "name       kv-app-prod") || strings.Contains(scr, "version    3f9c2a") {
+		t.Errorf("vault not described:\n%s", scr)
+	}
+	d.keys("1") // its subscription
+	if scr := d.screen(); !strings.Contains(scr, "name       platform-prod") || !strings.Contains(scr, "vaults     3") {
+		t.Errorf("subscription not described:\n%s", scr)
+	}
+	// Into the fourth pane: it keeps describing the subscription, and
+	// shift+tab goes back there.
+	d.keys("4")
+	if !strings.Contains(d.screen(), "name       platform-prod") {
+		t.Errorf("lost the subscription:\n%s", d.screen())
+	}
+	d.keys("shift+tab")
+	if d.m.focus != paneSources {
+		t.Errorf("back to %v", d.m.focus)
+	}
+	// A value revealed from a left pane stays in view until hidden.
+	d.keys("space")
+	if !strings.Contains(d.screen(), "correct-horse-battery-staple") {
+		t.Errorf("value not shown:\n%s", d.screen())
+	}
+}