Use mcdsl/terminal for all password prompts

Replace direct golang.org/x/term calls with mcdsl/terminal across init,
unseal, migrate-aad, and migrate-barrier commands. Seal password prompts
use ReadPasswordBytes to preserve zeroization capability.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/metacrypt/migrate_barrier.go

@@ -4,12 +4,10 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
-	"os"
-	"syscall"
 
 	"github.com/spf13/cobra"
-	"golang.org/x/term"
 
+	"git.wntrmute.dev/mc/mcdsl/terminal"
 	"git.wntrmute.dev/mc/metacrypt/internal/barrier"
 	"git.wntrmute.dev/mc/metacrypt/internal/config"
 	"git.wntrmute.dev/mc/metacrypt/internal/crypto"
@@ -62,9 +60,7 @@ func runMigrateBarrier(cmd *cobra.Command, args []string) error {
 	}
 
 	// Read unseal password.
-	fmt.Fprint(os.Stderr, "Unseal password: ")
-	passwordBytes, err := term.ReadPassword(int(syscall.Stdin))
-	fmt.Fprintln(os.Stderr)
+	passwordBytes, err := terminal.ReadPasswordBytes("Unseal password: ")
 	if err != nil {
 		return fmt.Errorf("read password: %w", err)
 	}