feat: the right pane describes what's selected in the pane you're in (#9)

The right pane kept showing the selected secret when you moved to Vaults or Sources. Now it follows focus:

| focus | right pane |
|---|---|
| Sources | the account (group row), or the subscription / workspace / repo: name, note, ID / profile / path, host or remote, account, web page, vault count |
| Vaults | the vault / scope / file: name, note, URI / backend / format, source, web page, counts of loaded secrets, keys, certificates |
| Secrets | the secret, as before |
| the right pane itself | what it described when you went in; `shift+tab` goes back there |

All but the secret use the `Fields` pane (#7), so `j`/`k`, `/` and `y` work on them; `Detail` loses the error message it got in #4, which is now a red "problem" row in `Fields`. A value revealed from a left pane stays in view until hidden, so `space` from any pane still shows it. `tab` from a subscription goes to Vaults as before; only an account row skips to its details.

This also changes the startup view: focus starts in Sources, so the right pane describes the first subscription instead of the first secret (golden output updated). Tests that read the secret pane focus Secrets first; a new test walks secret → vault → subscription → into the pane → back, and reveals from Sources.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #9

internal/ui/app/fields.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	tea "charm.land/bubbletea/v2"
+	"github.com/charmbracelet/x/ansi"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/provider"
 	"git.kebcloud.no/keb/lazysecrets/internal/ui/panes"
@@ -28,21 +29,67 @@ type groupsMsg struct {
 	err      error
 }
 
-// syncFields fills the Fields pane for what's selected, loading an
-// account's groups the first time.
+// detailOf is the pane the fourth pane describes: the one in focus, or,
+// with the fourth in focus, the one it was entered from.
+func (m Model) detailOf() pane {
+	if m.focus != paneDetail {
+		return m.focus
+	}
+	return m.lastLeft
+}
+
+// syncFields shows the Fields pane for what the focused pane has selected,
+// unless that's a secret (or a vault with the Secrets pane in focus), which
+// the secret pane shows, as it does a revealed value whatever the focus.
+// An account's groups load the first time.
 func (m *Model) syncFields() tea.Cmd {
-	acct, ok := m.selectedAccount()
-	if !ok {
-		m.fields.Set("", nil)
+	if m.detail.State() != panes.ValueHidden {
+		// A value revealed (or being fetched) from any pane stays in
+		// view until it's hidden.
+		m.fields.Hide()
 		return nil
 	}
-	r, _ := m.sources.Selected()
+	switch m.detailOf() {
+	case paneSources:
+		r, ok := m.sources.Selected()
+		switch {
+		case !ok:
+			m.fields.Show("", nil)
+		case m.selectedProblem() != "":
+			m.fields.Show(cmpOr(r.label, r.source.Name), m.problemFields(m.selectedProblem()))
+		case r.kind == rowGroup:
+			return m.showAccount(r)
+		case r.kind == rowSource:
+			m.fields.Show(r.source.Name, m.sourceFields(r.source))
+		default:
+			m.fields.Show("", nil)
+		}
+	case paneContainers:
+		if c, ok := m.containers.Selected(); ok {
+			m.fields.Show(c.Name, m.containerFields(c))
+		} else {
+			m.fields.Show("", nil)
+		}
+	default:
+		m.fields.Hide()
+	}
+	return nil
+}
+
+// showAccount shows a provider's account, loading its groups the first
+// time.
+func (m *Model) showAccount(r sourceRow) tea.Cmd {
+	p := m.byID[r.provider]
 	var fields []panes.Field
-	for _, f := range acct.Fields {
-		fields = append(fields, panes.Field{Label: f.Label, Value: f.Value})
+	if a, ok := p.(provider.Accounts); ok {
+		if acct, ok := a.Account(); ok {
+			for _, f := range acct.Fields {
+				fields = append(fields, panes.Field{Label: f.Label, Value: f.Value})
+			}
+		}
 	}
 	var cmd tea.Cmd
-	if g, ok := m.byID[r.provider].(provider.AccountGroups); ok {
+	if g, ok := p.(provider.AccountGroups); ok {
 		st, seen := m.groups[r.provider]
 		if !seen {
 			st = groupsState{loading: true}
@@ -57,10 +104,85 @@ func (m *Model) syncFields() tea.Cmd {
 		}
 		fields = append(fields, groupFields(st)...)
 	}
-	m.fields.Set(m.byID[r.provider].Label(), fields)
+	m.fields.Show(p.Label(), fields)
 	return cmd
 }
 
+// sourceFields describe a subscription, workspace or repo.
+func (m Model) sourceFields(src provider.Source) []panes.Field {
+	var out []panes.Field
+	add := func(label, value string) {
+		if value != "" {
+			out = append(out, panes.Field{Label: label, Value: value})
+		}
+	}
+	// Azure's detail is "subscription <ID>": the ID row says it.
+	id, detail := "ID", ""
+	switch src.Kind {
+	case provider.KindDatabricks:
+		id, detail = "profile", "host"
+	case provider.KindRepo:
+		id, detail = "path", "remote"
+	}
+	add("name", src.Name)
+	add("note", m.store.Node(sourceKey(src)).Note)
+	if src.ID != src.Name {
+		add(id, src.ID)
+	}
+	if detail != "" {
+		add(detail, src.Detail)
+	}
+	if src.ProviderLabel != string(src.Kind) {
+		add("account", src.ProviderLabel)
+	}
+	add("web", src.URL)
+	if e, ok := m.cache.containers[sourceRowKey(src.Provider, src.ID)]; ok {
+		label := map[provider.Kind]string{provider.KindDatabricks: "scopes", provider.KindRepo: "files"}[src.Kind]
+		add(cmpOr(label, "vaults"), fmt.Sprint(len(e.value)))
+	}
+	return out
+}
+
+// containerFields describe a vault, scope or file.
+func (m Model) containerFields(c provider.Container) []panes.Field {
+	var out []panes.Field
+	add := func(label, value string) {
+		if value != "" {
+			out = append(out, panes.Field{Label: label, Value: value})
+		}
+	}
+	add("name", c.Name)
+	add("note", m.store.Node(storeKey(c)).Note)
+	// The vault's URI, the scope's backend, the file's format.
+	switch c.Source.Kind {
+	case provider.KindAzure:
+		add("URI", c.Detail)
+	case provider.KindDatabricks:
+		add("backend", c.Detail)
+	case provider.KindRepo:
+		add("format", c.Detail)
+	}
+	add("source", cmpOr(c.Source.ProviderLabel, string(c.Source.Kind))+" / "+c.Source.Name)
+	add("web", c.URL)
+	for _, t := range c.ObjectTypes() {
+		if e, ok := m.cache.objects[containerKey(c)+"|"+string(t)]; ok {
+			add(strings.ToLower(string(t))+"s", fmt.Sprint(len(e.value)))
+		}
+	}
+	return out
+}
+
+// problemFields show why an account has nothing to show, wrapped to the
+// pane, in red.
+func (m Model) problemFields(problem string) []panes.Field {
+	var out []panes.Field
+	for _, l := range strings.Split(ansi.Wrap(problem, max(20, m.fields.Width()-16), " "), "\n") {
+		out = append(out, panes.Field{Value: l, Info: true, Err: true})
+	}
+	out[0].Label = "problem"
+	return out
+}
+
 // fieldName names a copied field: its label, or for a group, the group.
 func fieldName(f panes.Field) string {
 	if f.Label == "" || strings.HasPrefix(f.Label, "groups") {