Add a variables screen

[andreisuslov]

Refs #279.

Posting resolves $VARIABLES into requests, but there is no way to see what is currently defined without opening the .env file, and no way at all to see variables a script set through set_variable, since those exist only in memory.

This adds a screen that lists every variable a request can resolve, shows where each one came from, and lets you change them without dropping into a post-response script.

Open it with ctrl+p -> variables: Show variables, or ctrl+shift+v.

key	action
/	filter
e	edit value
a	add variable
d	revert override
s	show/hide secrets
c	copy value
$	copy $NAME
u / ctrl+r	undo / redo

Notes on the design

Source column. A session variable hides an environment file variable of the same name. Nothing surfaces that today, so a value that looks stale gives you no way to tell which one you are reading. Each row says session or env file.

Edits are session only. Environment files are never written to. That keeps the behaviour identical to set_variable, and it avoids two problems that would need solving first: load_variables flattens provenance, so with several --env files there is no way to know which file an edit belongs to, and rewriting a dotenv file does not reliably preserve comments. Reverting an override reloads the files and re-overlays the rest of the session, the same way the file watcher already does.

Happy to add write-back if you want it, but it seemed worth keeping out of a first pass.

Masking. Values whose names contain secret, password, token or api_key are masked until you press s, so opening the screen during a screen share or a recording does not put a token on the wall. The mask is a fixed width so it does not disclose the length either, and copy always copies the real value rather than the mask.

Renaming is not offered. It would break every request that still referenced the old name, and nothing would report it until the next send.

Undo history lives on the app beside session_env, so closing and reopening the screen keeps it. Capped at 50 entries.

Tests

tests/test_variables_modal.py covers the masking, filtering, sorting and source labelling rules as plain sync tests, matching the style of the existing suite. The row building is a pure function so those rules can be checked without starting an app.

I also drove the screen through run_test() while developing to check the key handling, clipboard, undo and redo, and the empty state.

Three command palette snapshots change because the palette now lists one more entry. 202 passed, 4 skipped locally.

Open questions

• ctrl+shift+v for the global binding is a guess, and some terminals swallow it. Happy to drop the binding and leave it palette only, or take whatever you prefer.
• escape and j/k are hidden from the footer, matching KeyValueCopyModal. Say the word if you would rather they showed.

[andreisuslov]

@darrenburns Sir, any chance you could look into that?