Implement auth secret deletion from selector menu

[abhishekp106]

Summary

• Adds a right-aligned X affordance on each Warp-managed secret row in the ambient auth selector chip menu (non-Oz cloud harnesses)
• Wires deletion through HarnessAvailabilityModel::delete_auth_secret with new AuthSecretDeleted / AuthSecretDeletionFailed events
• Clears the chip selection and persisted last_selected_auth_secret when the deleted secret was the active one
• Shows success/failure toasts and drops duplicate delete clicks while a request is in flight

Implements the behavior described in specs/cloud-mode-auth-secret-deletion/PRODUCT.md and TECH.md on this branch.

Key changes

• app/src/ai/harness_availability.rs: AuthSecretEntry now carries SecretOwner (mapped from the GraphQL Space); delete_auth_secret calls ManagedSecretManager::delete_secret, updates the cache, and emits the new events.
• app/src/menu.rs: opt-in right-side icon action on MenuItemFields. Clicking the right-side icon dispatches a separate action via its own Hoverable, suppressing the row's click. Existing decorative with_right_side_icon callers are unchanged.
• app/src/terminal/view/ambient_agent/auth_secret_selector.rs: tracks pending_deletes, renders the X on managed-secret rows only, handles DeleteSecret, and reacts to AuthSecretDeleted / AuthSecretDeletionFailed.
• All existing HarnessAvailabilityEvent match sites (FTUX dropdown, FTUX view, model selector, orchestration config block, run-agents card) updated to remain match-exhaustive; Deleted refreshes pickers so the secret disappears across surfaces.
• crates/managed_secrets/src/client.rs: SecretOwner now derives PartialEq, Eq, Hash so it can ride along on the selector's PartialEq action enum.

Test plan

• Open the auth selector chip menu with multiple secrets; confirm only existing secret rows show a right-aligned X (no X on header, "Inherit", "New", loading/error, or sidecar rows)
• Delete an unselected secret; confirm it disappears and a success toast appears
• Delete the currently selected secret; confirm the chip falls back to the inherit label and the persisted selection is cleared
• Force a failure (offline / unauthenticated); confirm the row remains, current selection is unchanged, and a failure toast appears
• Click X repeatedly while a delete is pending; confirm only one request fires
• Confirm clicking the X does not also select the row

This PR was created by Oz (running Claude Code).