feat: add hidden tag to hide hosts from TUI and search

Hosts tagged with "hidden" are excluded from the TUI list, shell
completions, and sshm search. Direct connections via sshm <host>
still work regardless of the tag.

A toggle key (H) shows or hides hidden hosts in the TUI, with a
yellow banner indicating the active state. The key is documented
in the help panel (h).

A contextual hint on the Tags field in the add and edit forms
reminds the user that "hidden" hides the host from the list.

internal/ui/tui.go

@@ -48,7 +48,7 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 
 	// Create the model with default sorting by name
 	m := Model{
-		hosts:          hosts,
+		allHosts:       hosts,
 		historyManager: historyManager,
 		pingManager:    pingManager,
 		sortMode:       SortByName,
@@ -63,8 +63,12 @@ func NewModel(hosts []config.SSHHost, configFile string, searchMode bool, curren
 		searchMode:     searchMode,
 	}
 
+	// Apply visibility filter (showHidden is false by default)
+	visibleHosts := m.applyVisibilityFilter(hosts)
+	m.hosts = visibleHosts
+
 	// Sort hosts according to the default sort mode
-	sortedHosts := m.sortHosts(hosts)
+	sortedHosts := m.sortHosts(visibleHosts)
 
 	// Create the search input
 	ti := textinput.New()