feat(chat): handle sudo.request / secret.request and respond via RPC (fixes #524) (#539)

Previously mobile dropped the gateway's sudo.request and secret.request
events, so any agent turn needing a sudo password or a secret value hung
forever with no UI. Now:
- EventParser maps sudo.request / secret.request -> WsEvent.SudoRequest / SecretRequest
- ChatViewModel surfaces a secure dialog (SudoPromptUi / SecretPromptUi) and
  replies via sudo.respond / secret.respond with session_id + request_id + payload
- ChatWsEventReducer explicitly branches the new events (no-op, VM-owned)
- ChatScreen renders password-masked SudoPromptDialog / SecretPromptDialog
- 6 unit tests cover prompt-state, RPC params, and prompt-clearing

Mirrors desktop/web contract (apps/shared GatewayEventName + tui_gateway).
Derives from audit of /opt/hermes-agent desktop app.

app/src/main/res/values/strings.xml

@@ -12,6 +12,12 @@
     <string name="chat_clarify_response">Response</string>
     <string name="chat_send">Send</string>
     <string name="chat_dismiss">Dismiss</string>
+    <string name="chat_sudo_title">Sudo Password Required</string>
+    <string name="chat_sudo_body">The agent needs your sudo password to continue. It will not be shown.</string>
+    <string name="chat_sudo_password">Password</string>
+    <string name="chat_secret_title">Secret Required</string>
+    <string name="chat_secret_body">The agent needs a secret value (token or password) to continue. It will not be shown.</string>
+    <string name="chat_secret_value">Secret</string>
     <string name="chat_search_placeholder">Search messages\u2026</string>
     <string name="chat_clear_search_desc">Clear</string>
     <string name="chat_prev_match_desc">Previous match</string>