[gg582]

Summary

Mask password arguments with * when entering /login <password> or /signup <password> in the login TUI.

Changes

• Introduce session_is_password_command: returns true once the buffer contains a /login or /signup command prefix (case-insensitive, allows leading whitespace).
• Update session_read_line:
  • When mask_input is enabled or session_is_password_command(buf) matches, echo * instead of plaintext.
  • Maintain null-termination after input and backspace operations to ensure safe string comparisons.
• Add unit tests in tests/unit/test_host_persistence.c verifying matching behavior for /login, /signup, and non-password commands.