Split data_app_service.py / commands/data_app.py over file-size ceilings

[padak]

Context

Surfaced by the kbagent-pr-reviewer during review of #330 (NB-1, non-blocking).

Two files are above the CONTRIBUTING.md hard file-size ceilings:

File	LOC	Hard ceiling
src/keboola_agent_cli/services/data_app_service.py	~2081	1500
src/keboola_agent_cli/commands/data_app.py	~1401	1200

Both crossed their ceilings before #330 (which added only +66 / +21 lines for the secrets-get/remove plain-key fix), so #330 is not uniquely at fault and was approved. CONTRIBUTING.md nonetheless says: "When a file crosses the hard ceiling, splitting is required before merging more functionality into it." Tracking the split here so the next feature touching data apps does it.

Suggested split (reviewer's recommendation)

Extract the secrets sub-lifecycle into a dedicated module:

• Service: move set_data_app_secrets, list_data_app_secrets, get_data_app_secret, remove_data_app_secrets, plus the secrets helpers (_read_secrets_block, _merge_secrets_into_body, _validate_secret_key, _derive_encryption_prefix, the SECRET_*_PATTERN / _derive_runtime_env_var_name / _secret_fingerprint module functions) into services/data_app_secrets_service.py.
• Commands: consider a parallel commands/data_app_secrets.py registered onto the same data-app Typer group, or splitting the logs / validate-repo / create sub-trees out.

Keep the 3-layer architecture and the Plugin synchronization map intact; no behavior change. Re-run make check (file-size budget is enforced there).

Acceptance

• Both files under their ceilings.
• make check green; no command-surface or JSON-envelope change.