[datlechin]

Summary

• Show password on the connection form's password field.
• Revealing a password read from the Keychain asks for Touch ID or the Mac's password first, in the form and in the profile editor.
• Test Source runs a password source without connecting: in the profile editor, on a connection whose connections.json entry names a source, and under a linked profile in the form (with that connection's host, port, user and database).
• A test shows the result hidden behind the same reveal, or the error with the command's stderr. It never reads or fills the command reuse cache.
• Test Source follows the connect trust rule: nothing runs from a connections.json or profiles file changed outside TablePro, except a source typed in the profile editor.
• A connection with a source shows its kind and value instead of an empty password field.
• Test Connection uses the connection's source whenever Connect would. A Keychain password left beside the source used to win, so the test passed where Connect failed.
• Test Connection asks for the password when Prompt for password is on. It tested with an empty password.
• Save These as a Profile… keeps a source (only from a trusted connections.json, else Ask every time) or ~/.pgpass. It made a Keychain profile with no password.
• A profile connect refused for an edited profiles file no longer tells the user to save the connection, which never re-trusts that file.

Test plan

• New: SecretRevealTests, PasswordSourceTestModelTests, AuthPanePasswordSourceTests, two cases in PasswordSourceResolverTests.
• verify.sh test: 208 of 208 across those and the connection form, credential profile, IAM and execution gate suites.
• No screenshots: this session had neither Accessibility nor Screen Recording access, so the app could not be driven or captured.

Fixes #2486