feat(tui): integrated rules editor (#3)

[Fraser-Isbester]

What

Adds an integrated rules editor to the TUI. In the :rules view:

• n — new rule, e — edit selected, d — delete (with confirm), Space — toggle enabled/disabled.
• Rules are authored in a tview form with per-resource CEL autocomplete and live validation (compiles against the resource's CEL env; requires a bool result).
• Edits persist to ~/.config/tusk/config.yaml and the running engine is hot-swapped (effective next tick).

Why

Issue #3: "Add the ability to manage Rules directly in the TUI." Previously rules were read-only in the UI and only editable by hand-editing the config file.

How persistence works

config.SaveProfileRules edits only the profile's rules: node in the YAML tree, so:

• Comments, key order, and all other fields (other profiles, connection URLs) are preserved.
• Env-derived defaults (port, refresh_interval) and env passwords are never written.
• Output is 2-space indented to match the documented style; RuleConfig optional fields gain omitempty.

Hardening beyond the prototype

• Save/delete/toggle surface errors via a modal and only swap on success.
• Duplicate rule names rejected (incl. rename collisions).
• Rules view auto-selects the first row so edit/delete/toggle work on entry.
• Editing guarded when there's no config-backed profile (positional-URL cli path) with a clear message — no no-op, no crash.
• SetEngine added to the rules and violations views for the zero-rules→engine bootstrap.

Validation

• go build ./..., go vet ./..., golangci-lint run ./... (0 issues), go test -race ./... pass; go mod tidy clean.
• Unit tests: SaveProfileRules round-trips — creates file when absent; preserves comments & unrelated keys; omits defaults and never writes an env password; add/edit/remove.
• End-to-end against local Postgres via a PTY: created a rule (comment preserved, clean 2-space YAML, no dry_run/cooldown noise), toggled it, exercised the engine-bootstrap path (profile started with zero rules), and confirmed the positional-URL guard doesn't crash.

Review guide

• internal/config/config.go — SaveProfileRules (comment-preserving YAML-node edit).
• internal/tui/views/rule_form.go — the form (CEL validation/autocomplete).
• internal/tui/app.go — key wiring + saveRule/deleteRule/toggleRule/recompileAndSwap + guards.

Closes #3

[Fraser-Isbester]

Reviewed for simplicity and data integrity.

Good reuse rather than new machinery — it leans on BuildRules/UpdateRules and the existing view/engine wiring. The persistence choice is the right one: editing only the profile's rules: node preserves comments and unrelated keys, keeps env-derived defaults and passwords out of the file, and the temp-file + rename write is atomic. Errors surface to the user instead of being swallowed, and the positional-URL path is guarded rather than silently no-oping. Validating CEL in the form before save keeps invalid expressions off disk and out of the engine.

No blocking concerns.