fix(ui): mask sensitive variable values on entry (cross-browser)

[mattrobinsonsre]

Entering a variable value marked Sensitive showed it in plaintext on screen while typing — only the saved list/table masked it (***). This masks the value as you enter it, the same class of fix as the #503 token reveal.

Change

• New SensitiveValueInput component: when Sensitive is checked, the value field is masked by default with a Show/Hide toggle. Wired into the workspace Variables tab and admin Variable Sets (both add + edit).
• Masking uses a vendored disc font (.text-masked + @font-face, text-security-disc, ~2 KB woff2) instead of -webkit-text-security, which is Chromium/WebKit-only — so it works in Firefox too — while staying a multi-line <textarea> so certs/keys paste intact. Gated on a non-empty value so the placeholder stays readable.
• Non-sensitive values render exactly as before. The .text-masked utility is reusable for any future masked field.

Verification

• Verified in headless Chromium against the real app CSS: the font loads and two different characters render to pixel-identical discs (i.e. it genuinely masks). Confirmed visually in the local stack in Chrome and Firefox.
• Playwright assertion added: the entry field gains/loses the masking class as Sensitive is toggled and Show/Hide clicked.
• npm run build, tsc, eslint clean.

Intended for a v0.38.3 fix release.