data-app secrets-set: support plaintext (unencrypted) environment variables #738

Problem

kbagent data-app secrets-set only accepts #KEY=VALUE entries and always encrypts the value. Keboola data apps also support plain (unencrypted) environment variables in parameters.dataApp.secrets - a key without the # prefix - and the UI offers exactly that ("optional encryption"). Non-secret configuration such as a Storage Files tag, a feature flag or a log level should stay readable in the configuration so that data-app detail / secrets-list and the UI show the actual value instead of <encrypted>.

With kbagent today:

kbagent data-app secrets-set --project p --app-id 74021026 --secret 'SCORING_BACKUP_TAG=ppl-assessment-db'
# rejected: entries must be '#KEY=VALUE'
kbagent data-app secrets-set --project p --app-id 74021026 --secret '#SCORING_BACKUP_TAG=ppl-assessment-db'
# accepted, but the value is now encrypted and invisible to everyone

The workaround is sync pull, editing _config.yml by hand (SCORING_BACKUP_TAG: value next to the '#KEY' entries) and sync push.

Proposal

• data-app secrets-set: accept KEY=VALUE (no #) as a plaintext env var and write it as-is; keep #KEY=VALUE encrypted. Perhaps name it env-set with --secret/--plain per entry, or add data-app env-set alongside secrets-set.
• secrets-list: show plaintext entries with their value and encrypted entries as <encrypted>.
• secrets-remove: already accepts the key with or without #; make sure it removes the plaintext variant too.

Context: https://github.com/padak/ppl_assessment - the app reads SCORING_BACKUP_TAG to find its SQLite backups in Storage Files; the value is not a secret and operators want to see it.