No secure key management: CLI source key provided in plaintext env var with no hardware wallet or keystore support

[ALLEN-AYODEJI]

Description

The TRELLIS_SOURCE_KEY env var stores the source account secret key in plaintext. Every CLI invocation passes this key to the stellar CLI which may write it to process lists, shell history, or debug logs. There is no support for hardware wallets (Ledger), encrypted keystores, or OS keychain integration.

Requirements and context

• Security: Standard security review required for state-mutating changes
• Testing: Full test suite must pass; new tests for changed behavior
• Documentation: Update doc comments and README if user-facing

Suggested execution

Branch: fix/fix/security-key-management

Implement changes

• Support alternative key sources: OS keychain (macOS Keychain, Linux secret-tool), encrypted keystore file
• Warn when the source key is provided via plaintext env var with instructions for secure alternatives
• Explore Ledger Stellar app integration for hardware wallet signing
• Add a trellis keys add/remove/list command for keystore management

Test and commit

Test with env var (current behavior) — verify warning. Test with keystore file — verify key loaded correctly. Test with invalid key — verify error. Run cargo test.

Example commit message

fix(security): add encrypted keystore support as alternative to plaintext env var secret key

Guidelines

• Open a PR against master
• Keep PR focused on this single concern
• Run cargo test or npm test before review
• Ensure no lint or typecheck warnings