Add pam launch from SuperShell

[craiglurey]

Summary

• Adds a one-key path (L) from the SuperShell TUI to a KeeperPAM terminal session for pamMachine and pamDatabase records, suspending Textual while the session is live.
• Cleans up the Detail view for those record types — hides the noisy raw pamHostname / pamSettings / trafficEncryptionSeed / checkbox:* fields and replaces them with a parsed Launch section showing protocol, host, credential, and a visual "Press L to Launch " button. JSON view is unchanged.
• Makes pam launch interactive when allowSupplyHost: True and the record has no static hostname — prompts for host:port instead of erroring out, with retries and the format spelled out in the prompt.
• Drive-by: fixes the misleading Use login --server <region> hint that keeper login prints in batch mode (it was dispatching to login(1) instead of keeper).

Notable design choices

• is_launchable() and get_launch_info() are now module-level helpers in pam_launch/launch.py so the TUI and the CLI share eligibility logic. Both read only cached vault data — safe for SuperShell's render path (no API calls during init/sync).
• SuperShell uses App.suspend() to release the terminal during launch, then resumes after the session ends. CommandError is caught and shown without a traceback; generic exceptions still log with traceback. Both pause for Enter so the user sees the message before the TUI redraws.
• Multi-line dict values (like pamSettings) are stripped from Detail view via brace-counting in _strip_pam_internal_fields, so continuation lines don't leak through.
• L follows the existing capital-letter action convention (P, W, D); lowercase l is taken by vim cursor-right.

Test plan

• keeper supershell — pamMachine record with static host + userRecords (image Make loading of a record from data into a utility function #1 in design discussion): Detail panel shows Launch section with resolved host:port and credential title; pressing L connects.
• pamMachine with allowSupplyHost: True and no hostname: Launch section shows Host: (prompted at launch); pressing L prompts for host:port with the format hint, accepts a valid value, and connects. Bad input (e.g. 127.0.0.1 with no port) re-prompts with the validation error in red rather than crashing.
• pamMachine with allowSupplyUser: True plus a static credential: Launch section shows Credential: <title> (or supplied at launch).
• Non-launchable record (login type, pamUser): no Launch section, no L hint in shortcuts bar; pressing L shows "This record is not launchable".
• JSON view (t toggle) on a pamMachine: still shows full pamSettings / pamHostname raw — only Detail view is filtered.
• keeper pam launch <uid> from keeper shell (no SuperShell): existing CLI behavior unchanged for records with static hostnames.
• keeper login from system shell (batch mode): hint reads keeper login --server <region>. Inside keeper shell: hint reads login --server <region>.
• ? in SuperShell: Help modal lists the new L shortcut under Actions.