feat: H shows what's hidden; Spring keys that don't look secret are hidden

Sources, files and secrets get a Hidden flag. The repo provider marks
Spring keys that match neither pattern, files with only those, and repos
with only such files, instead of leaving them out.

- Hidden items are left out of the panes, Go to and lazysecrets list;
  a pane's counter says how many it hides.
- H (lists.toggleHidden) shows them, dimmed whole in mutedColor;
  list --hidden lists them, json marks them "hidden".
- A revealed empty value shows "∅ no value (an empty string)", muted,
  instead of a blank line.

docs/integration.md

@@ -51,6 +51,7 @@ so `^prod` finds names starting with prod.
 | `--cached` | only what's cached, at once: nothing is loaded from Azure or Databricks |
 | `--max-age 2m` | load cached lists older than this again |
 | `--errors=false` | leave out the vaults and sources it couldn't read |
+| `--hidden` | list what's [hidden](repos.md#spring-boot-config) too, as `H` shows it (json: `"hidden": true`) |
 | `--color never` | no colours, for scripts |
 | `--icons=false` | no provider icons |
 | `--stars=false` | no ★ before starred names (in `favouriteColor`) |

docs/keys.md

@@ -20,6 +20,7 @@ The rule: a letter in the lists, ctrl+ that letter where you type a filter
 | `[` / `]` | previous / next tab of the focused pane: Sources and Favourites in Sources; Secrets, Keys, Certs in Secrets |
 | `/` | filter the focused list by name or note ([how it matches](#searching)); `enter` keeps it, `esc` clears it. While typing: `ctrl+j`/`ctrl+k` move, `ctrl+y` copies, `ctrl+r` reveals, `ctrl+f` stars |
 | `` ` `` | switch the Sources pane between grouped by provider and a flat list; `enter`/`space` on a provider folds it |
+| `H` | show / hide what's hidden: [Spring keys](repos.md#spring-boot-config) that don't look secret, and files and repos with only those; shown dimmed |
 | `r` | refresh the focused pane |
 | `q`, `ctrl+c` | quit |
 

docs/repos.md

@@ -69,7 +69,8 @@ sharing:
 
 `application.yml`, `application-prod.properties`, `bootstrap.yaml` and the
 like, tracked by git (not those in a Helm chart's `templates/`). Most of
-their keys aren't secret, so only those that look like one are listed:
+their keys aren't secret, so only those that look like one are listed; the
+rest are hidden:
 
 - **keys** named like a secret: ending in `password`, `pwd`, `secret`,
   `token`, `key`, `credentials`, `salt`, `connection-string` and the
@@ -78,9 +79,11 @@ their keys aren't secret, so only those that look like one are listed:
   password (`jdbc:postgresql://app:pw@db/app`), or a connection string
   with `AccountKey=`, `SharedAccessKey=` or `Password=`.
 
-A file's details count the keys left out, and `e` opens it whole. A
-`${DB_PASSWORD}` value is marked as a reference: the secret is set
-elsewhere. A tracked file is marked in red only when a listed key has its
+A file with none is hidden too, and a repo with only such files. `H` shows
+what's hidden, dimmed, in the panes and in Go to (`lazysecrets list
+--hidden` lists it); a pane's counter says how many it hides. A file's
+details count its hidden keys, and `e` opens it whole. A `${DB_PASSWORD}`
+value is marked as a reference: the secret is set elsewhere. A tracked file is marked in red only when a listed key has its
 value in plain text.
 
 Each list of regexps replaces its default; `keys: [".*"]` lists every key: