feat(list): add --json flag to phantom list

[mvanhorn]

Resolves #37.

Add a --json flag to phantom list so CI scripts, hooks, and other automation can consume the secret list as structured data instead of grep+awking the human-readable table.

Output

[
  { "name": "OPENAI_API_KEY", "detected_service": "openai" },
  { "name": "DATABASE_URL",   "detected_service": null    }
]

detected_service is the service name from .phantom.toml whose secret_key matches the secret name, or null when no service is configured. Names are emitted in vault order.

Changes

• crates/phantom-cli/src/main.rs — change Commands::List from a unit variant to List { json: bool } and pass the flag through to commands::list::run.
• crates/phantom-cli/src/commands/list.rs — serialise via a private SecretEntry struct with #[derive(Serialize)] and emit serde_json::to_string_pretty. The default human path is unchanged; the JSON path returns early before the human banner so output is pure JSON (safe to pipe to jq).
• crates/phantom-cli/Cargo.toml — add serde (workspace) since the command file now derive(Serialize)s. serde_json was already a dependency.
• crates/phantom-cli/tests/list_json_test.rs — three integration tests:
  1. emits valid JSON containing every vault secret name
  2. secret values never appear in the JSON output
  3. empty vault returns []

Verification

• cargo test -p phantom-secrets --test list_json_test: all 3 pass.
• cargo clippy -p phantom-secrets --all-targets -- -D warnings: clean.
• cargo fmt --all -- --check: clean.
• Default phantom list output is byte-identical to before the change.

Acceptance criteria

• --json flag added; existing human output is the default
• JSON output is valid JSON (verified via serde_json::from_str)
• No secret values appear in the JSON
• One integration test in crates/phantom-cli/tests/ covers the new flag (three actually — happy path, value-leak guard, empty vault)

[vercel]

@mvanhorn is attempting to deploy a commit to the Evero Team on Vercel.

A member of the Team first needs to authorize it.