fix: include encrypted value in create --secret payload

[jkebinger]

Summary

• Fix reforge create --secret not including the encrypted value in the API payload
• Extract mapConfigValueToDto to shared utility to prevent similar bugs
• Add set-default --secret to interactive menu for consistency

Problem

When using reforge create --secret, the POST payload was missing the value field:

{
  "value": {
    "type": "string",
    "confidential": true,
    "decryptWith": "reforge.secrets.encryption.key"
  }
}

The value field containing the encrypted string was not being included.

Solution

• makeConfidentialValue returns {value: encrypted, confidential, decryptWith}
• mapConfigValueToDto wasn't checking for configValue.value
• Extracted to shared utility so both create and set-default use the same code path
• Added test mock validation to catch this in the future

Test plan

• All 284 tests pass
• Build passes
• Lint passes
• Manual test: reforge create test.secret --type=string --value=test --secret

🤖 Generated with Claude Code

[jdwyah]

thanks