guide: read-only guided manual-rotation layer (links + worklist + TUI)
Advances the guided-rotation goal without rotating anything.
- internal/links: offline change-password URL generation — curated per-service
table + RFC 8615 /.well-known/change-password + parent-domain fallback; derives
a web host from a credential (git/netrc "user @ host", docker registry, aws)
- internal/worklist: secrets-free rotation worklist (source, identity, auto/manual,
link) + Markdown renderer
- internal/tui: Bubble Tea walk-through (one credential per screen, open link,
mark done/skip, progress) — READ-ONLY, enters/stores no secret
- cmd: `incredigo worklist` (offline, stdout/--out) and `incredigo guide` (TUI)
- tests: link derivation, worklist build/markdown + no-secret-column, TUI
navigation/done/quit/view
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
leetcrypt
71a74e7166