feat(#83): variables readout, two clear move actions, args->env relocation

Field testing showed the feature was doing the right thing but describing it
wrong, and left the moved variable invisible. Reworked per that feedback:

Naming. "Move to environment variable" read like "move into the Environment
variables table"; it actually creates a ${VAR} reference to the shell/OS
environment. Renamed the action to "Replace with a ${VAR} reference (out of
file)…" everywhere, and the dialog now says plainly the secret goes to your
shell environment -- not this file, not the table below.

Visibility (the real gap). A lone ${SECRET_KEY} with nothing saying whether
it's wired up isn't much better than a mystery. New Variables… button opens
ReferencedVarsDialog: every ${VAR} the loaded server references, each with
✓ set / ✓ default / ✗ not set and the exact export/setx line to set it.
Backed by pure core.referenced_env_vars (dedupes across fields, resolves
against a given environment or a default).

Two actions on an args secret, because the user may want either:
  * "Replace with a ${VAR} reference (out of file)…" -- secret leaves the
    file (needs a client that expands refs; disabled with reason on Desktop).
  * "Move into Environment variables (kept in this config)…" -- relocates the
    arg into the env block where it's visible and editable. Works on any
    client (no ${VAR} needed). core.move_arg_to_env_block drops the flag+value
    and sets env[VAR]; the dialog warns it changes how the server launches.

Both args actions run through ServerEditor (moving into env touches args AND
the env table), which reloads the form from the transformed data.

Tests: +10 core (referenced_env_vars dedupe/status/default; move_arg_to_env_block
flag+value removal, bare positional, None on bad target). 488 passed, ruff
clean. New dialogs/menus are GUI, untestable in CI as before.

Refs #83

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EKwBecy6N83jnqQmw8ezwE

tests/test_core.py

@@ -3180,3 +3180,54 @@ def test_suggested_env_var_for_arg_uses_preceding_flag():
 def test_suggested_env_var_for_arg_falls_back_when_no_flag():
     args = ["ghp_secret"]
     assert c.suggested_env_var_for_arg(args, 0) == "SECRET"
+
+
+# --------------------------------------------------------------------------- #
+# Referenced-variables readout + args->env relocation (issue #83, "both")
+# --------------------------------------------------------------------------- #
+def test_referenced_env_vars_dedupes_and_reports_status():
+    data = {
+        "command": "npx",
+        "args": ["--token", "${GH_TOKEN}", "${GH_TOKEN}"],
+        "env": {"API_KEY": "${API_KEY}", "REGION": "${REGION:-us-east-1}"},
+    }
+    usages = c.referenced_env_vars(data, environ={"GH_TOKEN": "x"})
+    by = {u.name: u for u in usages}
+    assert set(by) == {"GH_TOKEN", "API_KEY", "REGION"}
+    # GH_TOKEN appears only in args, deduped to one entry, set in env -> resolved
+    assert by["GH_TOKEN"].fields == ("args",)
+    assert by["GH_TOKEN"].resolved is True
+    # API_KEY not set, no default -> unresolved
+    assert by["API_KEY"].resolved is False
+    # REGION has a default -> resolved regardless of environment
+    assert by["REGION"].has_default is True
+    assert by["REGION"].resolved is True
+    # sorted by name
+    assert [u.name for u in usages] == sorted(u.name for u in usages)
+
+
+def test_referenced_env_vars_empty_when_no_refs():
+    assert c.referenced_env_vars({"command": "npx", "args": ["-y", "pkg"]}) == []
+
+
+def test_move_arg_to_env_block_removes_flag_and_value():
+    data = {"command": "x", "args": ["--api-key", "sk-secret", "run"], "env": {"KEEP": "1"}}
+    out = c.move_arg_to_env_block(data, 1)
+    assert out["args"] == ["run"]  # flag + value both gone
+    assert out["env"]["API_KEY"] == "sk-secret"
+    assert out["env"]["KEEP"] == "1"  # existing env preserved
+    # input not mutated
+    assert data["args"] == ["--api-key", "sk-secret", "run"]
+
+
+def test_move_arg_to_env_block_bare_positional_keeps_no_flag():
+    data = {"command": "x", "args": ["ghp_secret", "serve"]}
+    out = c.move_arg_to_env_block(data, 0, var_name="GITHUB_TOKEN")
+    assert out["args"] == ["serve"]
+    assert out["env"] == {"GITHUB_TOKEN": "ghp_secret"}
+
+
+def test_move_arg_to_env_block_none_on_bad_target():
+    assert c.move_arg_to_env_block({"args": ["a"]}, 5) is None
+    assert c.move_arg_to_env_block({"args": ["${REF}"]}, 0) is None  # already a ref
+    assert c.move_arg_to_env_block({}, 0) is None