feat: Complete Phase 3 - Secrets & API Keys (RAKD/SOPS)

- Add RAKD (Required API Keys Document) system:
  - Service detection from package.json, go.mod, requirements.txt, and code
  - API key validation from .env file with format checking
  - RAKD.md generator with comprehensive status sections
  - Support for 10+ services (Stripe, SendGrid, AWS, Supabase, Auth0, Clerk, OpenAI, Sentry, etc.)

- Add SOPS (Service Operating Procedures) system:
  - Auto-generate service setup guides in .doplan/SOPS/
  - Templates for authentication, database, payment, storage, email, analytics, AI services
  - Each SOP includes: overview, setup steps, API key creation, env vars, code examples, testing, common issues, resources

- Implement keys management TUI:
  - Interactive service list with status indicators
  - Service detail view showing all API keys
  - Validate all keys (V key)
  - Sync .env.example (S key)
  - Navigation with arrow keys

- Add API keys status widget to dashboard:
  - Progress bar showing configuration percentage
  - Status summary (configured/pending/required/optional)
  - Warning highlight for high-priority missing keys
  - Keyboard shortcut [k] to open keys management

- Integrate with TUI menu and command executor
- Wire up keys command to menu action

Phase 3 of v0.0.19-beta complete.

Author: Test User

internal/commands/executor.go

@@ -57,8 +57,7 @@ func (e *TUICommandExecutor) UpdateProgress() error {
 }
 
 func (e *TUICommandExecutor) ManageAPIKeys() error {
-	// TODO: Implement keys command
-	return nil
+	return ManageAPIKeys()
 }
 
 func (e *TUICommandExecutor) ApplyDesign() error {

internal/commands/keys.go

@@ -0,0 +1,93 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/DoPlan-dev/CLI/internal/rakd"
+	"github.com/DoPlan-dev/CLI/internal/sops"
+	"github.com/DoPlan-dev/CLI/internal/wizard"
+)
+
+// ManageAPIKeys launches the API keys management TUI
+func ManageAPIKeys() error {
+	projectRoot, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("failed to get current directory: %w", err)
+	}
+
+	// Generate/update RAKD.md
+	_, err = rakd.GenerateRAKD(projectRoot)
+	if err != nil {
+		return fmt.Errorf("failed to generate RAKD: %w", err)
+	}
+
+	// Generate SOPS if they don't exist
+	sopsGen := sops.NewGenerator(projectRoot)
+	if err := sopsGen.GenerateAll(); err != nil {
+		return fmt.Errorf("failed to generate SOPS: %w", err)
+	}
+
+	// Launch keys management wizard
+	return wizard.RunKeysWizard()
+}
+
+// ValidateAPIKeys validates all API keys
+func ValidateAPIKeys() error {
+	projectRoot, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("failed to get current directory: %w", err)
+	}
+
+	data, err := rakd.GenerateRAKD(projectRoot)
+	if err != nil {
+		return fmt.Errorf("failed to validate keys: %w", err)
+	}
+
+	fmt.Printf("✅ Validated %d services\n", len(data.Services))
+	fmt.Printf("  Configured: %d\n", data.ConfiguredCount)
+	fmt.Printf("  Required (Missing): %d\n", data.RequiredCount)
+	fmt.Printf("  Pending: %d\n", data.PendingCount)
+	fmt.Printf("  Optional: %d\n", data.OptionalCount)
+
+	return nil
+}
+
+// SyncEnvExample syncs .env.example with detected keys
+func SyncEnvExample() error {
+	projectRoot, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("failed to get current directory: %w", err)
+	}
+
+	detector := rakd.NewDetector(projectRoot)
+	services, err := detector.DetectServices()
+	if err != nil {
+		return fmt.Errorf("failed to detect services: %w", err)
+	}
+
+	// Generate .env.example content
+	envExamplePath := fmt.Sprintf("%s/.env.example", projectRoot)
+	content := "# Environment Variables\n"
+	content += "# Copy this file to .env and fill in your values\n\n"
+
+	for _, service := range services {
+		content += fmt.Sprintf("# %s\n", service.Name)
+		for _, key := range service.Keys {
+			if key.Required {
+				content += fmt.Sprintf("%s=\n", key.EnvVar)
+			} else {
+				content += fmt.Sprintf("# %s=\n", key.EnvVar)
+			}
+		}
+		content += "\n"
+	}
+
+	if err := os.WriteFile(envExamplePath, []byte(content), 0644); err != nil {
+		return fmt.Errorf("failed to write .env.example: %w", err)
+	}
+
+	fmt.Printf("✅ Synced .env.example with %d services\n", len(services))
+	return nil
+}
+