feat: decrypt Jasypt values in .env and Spring files

ENC(...) values are decrypted on reveal, copy or get with
jasypt-spring-boot's default algorithm (3.0+, PBEWITHHMACSHA512ANDAES_256).

- The password is, as in Spring, $JASYPT_ENCRYPTOR_PASSWORD, else the
  file's own jasypt.encryptor.password (JASYPT_ENCRYPTOR_PASSWORD in a
  .env), with ${VAR} and ${VAR:default} read from the environment.
- Errors say which password was used, or which one is missing.
- Secrets show a detail after their name: jasypt, or reference for a
  Spring ${VAR}; also in Go to and Favourites.
- A .env whose values are all Jasypt isn't marked as plain text in git.

internal/ui/app/favourites.go

@@ -137,6 +137,9 @@ func (m Model) objectRender() func(styles.Styles, provider.Object, int) string {
 			line = sty.Muted.Render(o.Name + " (disabled)")
 		}
 		line = marks(sty, n, o.Container.Source.Provider, m.recentIcon, m.now()) + line
+		if o.Detail != "" {
+			line += sty.Muted.Render("  " + o.Detail)
+		}
 		switch state, left := m.expiry(o); state {
 		case expiry.Expired:
 			line += " " + sty.Error.Render("✗ expired")

internal/ui/app/jump.go

@@ -38,11 +38,13 @@ func (m *Model) storeEntries() (favs, recent []option) {
 			return nil
 		}
 		var out []entry
+		detail := m.objectDetail(key)
 		add := func(path []string, acct string, depth int, run func(*Model) tea.Cmd) {
 			account := ""
 			if p, ok := m.byID[acct]; ok {
 				account = accountOf(provider.Source{Kind: p.Kind(), ProviderLabel: p.Label()})
 			}
+			account = strings.Trim(detail+" · "+account, " ·")
 			sort := strings.ToLower(strings.Join(path, "/")) + " " + account
 			out = append(out, entry{depth, sort, option{
 				label: m.pathLabel(r.Kind, path, account), note: n.Note, mark: " ",
@@ -157,6 +159,19 @@ func (m Model) inPlainEnv(r ref.Ref) bool {
 	return false
 }
 
+// objectDetail is the Detail of the secret with the store key key, as far
+// as the lists loaded tell.
+func (m Model) objectDetail(key string) string {
+	for _, e := range m.cache.objects {
+		for _, o := range e.value {
+			if o.Detail != "" && objectKey(o) == key {
+				return o.Detail
+			}
+		}
+	}
+	return ""
+}
+
 // repoLabel draws a repo, or a file in it, as everywhere else: the repo
 // icon and colour, "app / apps/api/.env".
 func (m Model) repoLabel(repo string, file ...string) string {

internal/ui/app/search.go

@@ -90,7 +90,7 @@ func (m *Model) searchEntries() (sources, items []option) {
 						if err != nil {
 							continue
 						}
-						suffix := accountOf(src)
+						suffix := strings.Trim(o.Detail+" · "+accountOf(src), " ·")
 						if t != provider.TypeSecret {
 							typ := strings.TrimSuffix(strings.ToLower(pluralLabels[t]), "s") // "key"
 							suffix = strings.Trim(typ+" · "+suffix, " ·")