feat(secret,variable): read values like gh and report stored names

secret set and variable set read the value from -b/--body, -F/--body-file
or standard input when it is not a terminal (one trailing line break
removed), and otherwise prompt for it; --env-file sets every NAME=value
of a dotenv file. --value and --value-file keep working. The scope flags
are -o/--org and --account on each command, and secret list no longer
offers --account, which Gitea cannot list.

Commands report what they did, naming the scope and the name Gitea
stores: "Set Actions secret LOWER_NAME for alice/x (names are
upper-cased)"; --json returns the stored name and omits an unknown
creation time. Deleting asks "Delete secret X from alice/x?". Lists show
NAME, CREATED and DESCRIPTION for secrets and NAME, VALUE and DESCRIPTION
for variables; variable view shows a record and the new variable get
prints the raw value. A missing secret or variable is reported by name
and scope.

The global --user selects the account tea acts as, unlike gh's --user,
so secret and variable add a note on a terminal pointing to --account
when it is given, as run list does for --actor. Help explains the scopes.

Signed-off-by: bircni <bircni@icloud.com>

internal/app/validation_test.go

@@ -198,10 +198,10 @@ func TestUsageErrorsPrecedeRequests(t *testing.T) {
 		{[]string{"search", "issue", "--since="}, "invalid --since: use a date"},
 		{[]string{"search", "repo", "query", "--sort", "invalid"}, "--sort must be alpha, created, updated, size, or id"},
 		{[]string{"search", "repo", "query", "--order", "invalid"}, "--order must be asc or desc"},
-		{[]string{"secret", "set", "BUILD_TOKEN", "--value", "text", "--value-file", "-"}, "--value and --value-file are mutually exclusive"},
+		{[]string{"secret", "set", "BUILD_TOKEN", "--value", "text", "--value-file", "-"}, "--body and --body-file are mutually exclusive"},
 		{[]string{"secret", "set", "BUILD_TOKEN", "--value= ", "--json=value"}, "unknown JSON field \"value\""},
-		{[]string{"secret", "set", "BUILD_TOKEN", "--no-input"}, "missing value: supply --value or --value-file"},
-		{[]string{"secret", "set", "CI", "--value", "text"}, "CI and names beginning GITEA_ or GITHUB_ are reserved"},
+		{[]string{"secret", "set", "BUILD_TOKEN", "--no-input"}, "missing value: pass --body, --body-file or standard input"},
+		{[]string{"secret", "set", "CI", "--value", "text"}, "CI and names starting with GITEA_ or GITHUB_ are reserved"},
 		{[]string{"status", "--limit=0"}, `"--limit" flag: must be 1..100`},
 		{[]string{"status", "--json=token"}, "unknown JSON field \"token\""},
 		{[]string{"team", "create", "org", "--name", "Developers", "--permission", "owner"}, "--permission must be read, write, or admin"},
@@ -221,10 +221,10 @@ func TestUsageErrorsPrecedeRequests(t *testing.T) {
 		{[]string{"time", "list", "--from", "2026-10-02", "--until", "2026-10-01"}, "--from must not be later than --until"},
 		{[]string{"time", "list", "--from", "1h", "--until", "2h"}, "--from must not be later than --until"},
 		{[]string{"time", "list", "--total", "--json"}, "--total is a human-output summary"},
-		{[]string{"variable", "set", "BUILD_MODE", "--value="}, "variable value cannot be empty"},
-		{[]string{"variable", "set", "GITEA_RESERVED", "--value", "text"}, "CI and names beginning GITEA_ or GITHUB_ are reserved"},
-		{[]string{"variable", "list", "--org", "team", "--account"}, "--org, --account, and --repo select mutually exclusive scopes"},
-		{[]string{"variable", "list", "--org", "team", "--repo", "alice/project"}, "--org, --account, and --repo select mutually exclusive scopes"},
+		{[]string{"variable", "set", "BUILD_MODE", "--value="}, "the value of BUILD_MODE is empty"},
+		{[]string{"variable", "set", "GITEA_RESERVED", "--value", "text"}, "CI and names starting with GITEA_ or GITHUB_ are reserved"},
+		{[]string{"variable", "list", "--org", "team", "--account"}, "--org, --account and --repo select different scopes; pass one"},
+		{[]string{"variable", "list", "--org", "team", "--repo", "alice/project"}, "--org, --account and --repo select different scopes; pass one"},
 		{[]string{"version", "--json"}, "version prints text"},
 		{[]string{"webhook", "edit", "1", "--secret", "private", "--clear-authorization"}, "webhook secret editing is unsupported"},
 		{[]string{"webhook", "create", "ftp://host/path"}, "webhook URL must be an absolute HTTP(S) URL without user information or fragment"},
@@ -289,7 +289,7 @@ func TestPromptedCreateSubmitsWithoutConfirmation(t *testing.T) {
 		secret, write string
 	}{
 		{[]string{"secret", "set", "TOKEN"}, nil, "private", "PUT /api/v1/repos/alice/project/actions/secrets/TOKEN"},
-		{[]string{"variable", "set", "MODE"}, map[string]string{"Variable value": "fast"}, "", "POST /api/v1/repos/alice/project/actions/variables/MODE"},
+		{[]string{"variable", "set", "MODE"}, map[string]string{"Value of MODE:": "fast"}, "", "POST /api/v1/repos/alice/project/actions/variables/MODE"},
 		{[]string{"webhook", "create"}, map[string]string{"Payload URL": "https://hooks.test/path"}, "", "POST /api/v1/repos/alice/project/hooks"},
 		{[]string{"team", "create", "acme"}, map[string]string{"Team name": "Developers"}, "", "POST /api/v1/orgs/acme/teams"},
 	} {