fix(web-env): show masked secret input

[RSO]

Summary

• display one * for each character entered or pasted into pnpm web:env set secret prompts
• remove the corresponding mask when Backspace removes a character
• keep the plaintext secret hidden

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the readSecret mask/backspace change in scripts/web-env/shared.ts; the visual * / \b \b updates match the stored value and introduce no correctness or leak issues.

Files Reviewed (1 files)

• scripts/web-env/shared.ts

---

_{Reviewed by grok-4.6 · Input: 70K · Output: 6.4K · Cached: 131.1K}

_{Review guidance: REVIEW.md from base branch main}