fix: spec compliance for TUI DIALOGS section

- Rename CertFormResult.cancelled → confirmed (True=submit, False=cancel/Esc)
- Change _FORM_FIELDS from list to tuple
- Update _FORM_LABELS to exact values: CN, Email, Password
- Update _FORM_FIELD_Y to {cn:3, email:5, password:7}
- Add password param to show_cert_form (uses generate_password() if empty)
- Add mask=True to password InputField (both init and F5-regen sites)
- Add ord("Q") to show_confirm false-return condition
- Add KEY_UP/KEY_DOWN navigation in show_cert_form
- Add Ctrl-S (0x13) as immediate submit key in show_cert_form
- Update tests/test_dialogs.py: confirmed=True on submit, confirmed=False on cancel

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_dialogs.py

@@ -66,14 +66,14 @@ def test_show_confirm_esc():
 # ---------------------------------------------------------------------------
 
 def test_show_cert_form_cancel():
-    """Pressing Escape returns a CertFormResult with cancelled=True."""
+    """Pressing Escape returns a CertFormResult with confirmed=False."""
     stdscr = _make_stdscr()
     win = _make_win(rows=20, cols=70)
     win.getch.side_effect = [27]
     with patch("curses.newwin", return_value=win):
         result = show_cert_form(stdscr, cn="alice", email="alice@example.com")
     assert isinstance(result, CertFormResult)
-    assert result.cancelled is True
+    assert result.confirmed is False
 
 
 def test_show_cert_form_confirm():
@@ -90,7 +90,7 @@ def test_show_cert_form_confirm():
     with patch("curses.newwin", return_value=win):
         result = show_cert_form(stdscr, cn="bob", email="bob@example.com")
     assert isinstance(result, CertFormResult)
-    assert result.cancelled is False
+    assert result.confirmed is True
     assert result.cn == "bob"
     assert result.email == "bob@example.com"
     assert len(result.password) > 0