fix: use correct ExternalSecret CRD name for force-sync annotation

The force-sync pre-filled the ExternalSecret object name with the
Kubernetes secret name (e.g. job-apply-common-secrets), but the
kubectl annotate command must target the ExternalSecret CRD object
(e.g. job-apply). Added external_secret_name_template config option
with fallback to k8s_secret_name_template.

internal/config/config.go

@@ -50,6 +50,13 @@ type Config struct {
 	// naming conventions.
 	K8sSecretNameTemplate string `yaml:"k8s_secret_name_template"`
 
+	// ExternalSecretNameTemplate builds the ExternalSecret CRD object
+	// name that should be annotated when a force-sync is requested. This
+	// is often different from the Kubernetes secret name because the
+	// ExternalSecret CRD and the resulting Secret are separate objects.
+	// Falls back to K8sSecretNameTemplate if empty.
+	ExternalSecretNameTemplate string `yaml:"external_secret_name_template"`
+
 	// ContextTemplate builds the actual kubectl context name/ARN from
 	// region, account_id, env, and context, e.g.
 	// "arn:aws:eks:{region}:{account_id}:cluster/tf-{env}-{context}-1".
@@ -134,6 +141,23 @@ func (c Config) ResolveK8sSecretName(namespace string) string {
 	})
 }
 
+// ResolveExternalSecretName builds the ExternalSecret CRD object name for
+// a given namespace using ExternalSecretNameTemplate. Falls back to
+// K8sSecretNameTemplate (or SecretNameTemplate if that is also empty) so
+// that existing configs keep working without changes.
+func (c Config) ResolveExternalSecretName(namespace string) string {
+	template := c.ExternalSecretNameTemplate
+	if template == "" {
+		template = c.K8sSecretNameTemplate
+	}
+	if template == "" {
+		template = c.SecretNameTemplate
+	}
+	return kctl.ResolveTemplate(template, map[string]string{
+		"namespace": namespace,
+	})
+}
+
 // DefaultPath returns the default config file location: ~/.kctl-tui/config.yaml
 func DefaultPath() (string, error) {
 	home, err := os.UserHomeDir()