feat(profiles): support multiple repository sync profiles per vault

[ClaudiaFang]

Priority

Product capability — multi-destination publishing

Problem

A vault may contain content intended for different repositories and trust boundaries. A single global provider/repository configuration cannot safely represent public publishing, work documentation, and personal backup at the same time.

Goal

Support multiple named repository profiles, each with isolated destination, policy, credentials, and sync metadata.

Profile model

Each profile should own:

• provider and API host;
• repository and branch;
• remote base path / path mapping;
• include and exclude policy;
• credential reference;
• provider capabilities;
• independent sync metadata namespace.

Example

Public Blog
→ GitHub public repository
→ include `blog/**`

Work Docs
→ self-hosted GitLab
→ include `work/published/**`

Personal Backup
→ Gitea
→ selected private folders

Plan

• Define profile schema, stable ID, and settings migration from the current single configuration.
• Prevent metadata and credentials from leaking across profiles.
• Add profile selection to settings, commands, Sync Status, and confirmation dialogs.
• Define behavior when one local path matches multiple profiles.
• Support profile-specific connection testing and validation.
• Add import/export behavior that excludes secrets.
• Integrate profile names into Sync Plan explanations from feat(sync-plan): explain policy matches and planned actions #107.

Acceptance criteria

• Existing users migrate into one default profile without losing sync metadata.
• Two profiles can target different providers/repositories in the same vault.
• The active profile is always visible before executing remote changes.
• A file cannot be silently synced through an unintended profile.
• Tests cover migration, profile switching, overlapping rules, isolated metadata, and credential references.