feat(cli): add pic triggers + dead-letters + secrets subcommands

Closes the audit's High-severity CLI coverage gap, raising the count
from ~25 to ~40+ subcommands and bringing the integration test count
from 63 to 73.

- pic triggers {ls, rm, create-kv, create-cron, create-dead-letter,
  create-from-json}: three per-kind wrappers cover the most common
  trigger shapes; the generic create-from-json is the escape hatch
  for docs/files/pubsub/email/queue and any future advanced retry
  knobs — body JSON inline, via @<file>, or "-" for stdin.

- pic dead-letters {ls, show, replay, resolve}: full operator
  workflow for the dispatcher's dead_letters rows, including the
  --unresolved filter and the per-row replay + manual-resolve actions.

- pic secrets {ls, set, rm}: list names + updated_at, set values
  via stdin (the only secure channel — inline values would leak
  into shell history), and delete by name. --json on set treats
  stdin as raw JSON for non-string values.

Ten new integration tests follow the established #[ignore] pattern,
gated on DATABASE_URL. All 73 ignored tests pass against the local
dev stack.

The `pic admin reset-password` server-binary subcommand exists on
the picloud binary side already; the audit's "surface it in pic
--help" note is a one-line addition deferred to Stage 6 with the
other small UX touches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/secrets.rs

@@ -0,0 +1,113 @@
+//! `pic secrets` smoke tests. Covers set→ls→rm round trip and the
+//! "value must come from stdin" contract.
+
+use predicates::prelude::*;
+
+use crate::common;
+use crate::common::cleanup::AppGuard;
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn set_ls_rm_round_trip() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let slug = common::unique_slug("sec-rt");
+    common::pic_as(&env)
+        .args(["apps", "create", &slug])
+        .assert()
+        .success();
+    let _guard = AppGuard::new(&env.url, &env.token, &slug);
+
+    // Set — value via stdin (the only valid channel).
+    common::pic_as(&env)
+        .args(["secrets", "set", "--app", &slug, "api_key"])
+        .write_stdin("xyzzy")
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("Set secret api_key"));
+
+    // Ls — name appears, value never leaves the server.
+    let out = common::pic_as(&env)
+        .args(["secrets", "ls", "--app", &slug])
+        .output()
+        .expect("secrets ls");
+    let stdout = String::from_utf8(out.stdout).unwrap();
+    let header = stdout.lines().next().expect("header");
+    assert_eq!(common::cells(header), vec!["name", "updated_at"]);
+    assert!(
+        stdout.lines().skip(1).any(|l| l.starts_with("api_key")),
+        "api_key missing from ls: {stdout}"
+    );
+
+    // Rm — name dropped.
+    common::pic_as(&env)
+        .args(["secrets", "rm", "--app", &slug, "api_key"])
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("Deleted secret api_key"));
+
+    let out = common::pic_as(&env)
+        .args(["secrets", "ls", "--app", &slug])
+        .output()
+        .expect("secrets ls after rm");
+    let stdout = String::from_utf8(out.stdout).unwrap();
+    assert_eq!(stdout.lines().count(), 1, "no rows after rm: {stdout}");
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn set_empty_stdin_errors() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let slug = common::unique_slug("sec-empty");
+    common::pic_as(&env)
+        .args(["apps", "create", &slug])
+        .assert()
+        .success();
+    let _guard = AppGuard::new(&env.url, &env.token, &slug);
+
+    common::pic_as(&env)
+        .args(["secrets", "set", "--app", &slug, "anything"])
+        .write_stdin("")
+        .assert()
+        .failure()
+        .stderr(predicate::str::contains(
+            "empty stdin — secret value must not be empty",
+        ));
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn set_with_json_flag_round_trips_object() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let slug = common::unique_slug("sec-json");
+    common::pic_as(&env)
+        .args(["apps", "create", &slug])
+        .assert()
+        .success();
+    let _guard = AppGuard::new(&env.url, &env.token, &slug);
+
+    common::pic_as(&env)
+        .args(["secrets", "set", "--app", &slug, "cfg", "--json"])
+        .write_stdin(r#"{"endpoint":"https://example.com","retries":3}"#)
+        .assert()
+        .success();
+
+    // Ls confirms the name landed.
+    let out = common::pic_as(&env)
+        .args(["secrets", "ls", "--app", &slug])
+        .output()
+        .expect("ls");
+    let stdout = String::from_utf8(out.stdout).unwrap();
+    assert!(
+        stdout.lines().skip(1).any(|l| l.starts_with("cfg")),
+        "cfg missing: {stdout}"
+    );
+}