feat(07-02): add tooltipText to registry fields + render ⓘ in FieldRenderer and PasswordField

- Populate tooltipText for azureblob.sas_url, azureblob.key, and onedrive.token in registry
- Add tooltipText prop and showTooltip state to PasswordField with toggle button + panel
- Add showTooltip state to FieldRenderer; pass tooltipText to PasswordField for password branch
- Add ⓘ button + panel for text/select branches in FieldRenderer
- Use sr-only span for accessible name to avoid getByLabelText collision

src/schemas/registry.ts

@@ -41,6 +41,7 @@ export const BACKEND_REGISTRY = {
         inputType: 'password',
         required: false,
         helpText: 'Base64-encoded storage account key. Provide either this or a SAS URL, not both.',
+        tooltipText: 'The full storage account key grants unrestricted read/write access to all containers in the account. Keep this secret. If you only need limited access, use a SAS URL instead.',
       },
       {
         key: 'sas_url',
@@ -49,6 +50,7 @@ export const BACKEND_REGISTRY = {
         required: false,
         placeholder: 'https://mystorageaccount.blob.core.windows.net/?sv=...',
         helpText: 'Full SAS URL including account and container. Provide either this or an access key, not both.',
+        tooltipText: 'A SAS URL (Shared Access Signature) bundles the storage endpoint with a time-limited, scope-limited token. It grants access only to containers you specify and expires automatically. Use this if you want limited-access credentials. If you have the full account key, switch to Access Key.',
       },
     ],
   },
@@ -142,6 +144,7 @@ export const BACKEND_REGISTRY = {
         required: true,
         placeholder: '{"access_token":"...","token_type":"Bearer","refresh_token":"...","expiry":"..."}',
         helpText: 'Paste the JSON token from: rclone authorize "onedrive"',
+        tooltipText: 'This is the JSON token obtained by running `rclone authorize "onedrive"` on a machine with a browser. The command opens a browser window, you authenticate, and rclone prints a JSON token — paste that entire JSON blob here.',
       },
       {
         key: 'drive_id',