feat: add hidden tag to hide hosts from TUI and search

Hosts tagged with "hidden" are excluded from the TUI list, shell
completions, and sshm search. Direct connections via sshm <host>
still work regardless of the tag.

A toggle key (H) shows or hides hidden hosts in the TUI, with a
yellow banner indicating the active state. The key is documented
in the help panel (h).

A contextual hint on the Tags field in the add and edit forms
reminds the user that "hidden" hides the host from the list.

internal/ui/model.go

@@ -70,8 +70,10 @@ func (p PortForwardType) String() string {
 type Model struct {
 	table          table.Model
 	searchInput    textinput.Model
-	hosts          []config.SSHHost
+	allHosts       []config.SSHHost // all parsed hosts, including hidden ones
+	hosts          []config.SSHHost // visible hosts (filtered by showHidden)
 	filteredHosts  []config.SSHHost
+	showHidden     bool // when true, hidden-tagged hosts are shown
 	searchMode     bool
 	deleteMode     bool
 	deleteHost     *config.SSHHost // Host to be deleted (with line number for precise targeting)
@@ -108,6 +110,14 @@ type Model struct {
 	showingError bool
 }
 
+// applyVisibilityFilter returns hosts filtered according to the showHidden flag.
+func (m Model) applyVisibilityFilter(hosts []config.SSHHost) []config.SSHHost {
+	if m.showHidden {
+		return hosts
+	}
+	return config.FilterVisibleHosts(hosts)
+}
+
 // updateTableStyles updates the table header border color based on focus state
 func (m *Model) updateTableStyles() {
 	s := table.DefaultStyles()