Please add a secure stdin or template input mode to pass-cli item update.

In Proton Pass CLI 2.2.3, updating an item requires values to be passed through
arguments such as:

pass-cli item update \
--vault-name Production \
--item-id ITEM_ID \
--field "note=<sensitive value>"

This places the sensitive value in the process argument list. Depending on the
operating system and local tooling, it may be visible through process
inspection, diagnostics, audit collection, or crash reports. Avoiding shell
history does not eliminate this exposure.

Item creation already supports secure template input through
--from-template -. Please provide equivalent functionality for updates, for
example:

generate-update-template |
pass-cli item update \
--vault-name Production \
--item-id ITEM_ID \
--from-template -

An alternative interface such as the following would also solve the problem:

generate-secret |
pass-cli item update \
--vault-name Production \
--item-id ITEM_ID \
--field-from-stdin note

Why replacing the item is not equivalent

Automation can safely create a replacement item through stdin, but replacing an
existing item:

loses the stable item identity;
breaks Proton Pass revision history for that item;
requires external references to be updated transactionally;
can leave duplicate or orphaned items after an interrupted operation.

Secure in-place updates are especially useful for password and API-token
rotation, infrastructure automation, and headless workflows.

Suggested acceptance criteria

Update one or more fields without placing their values in argv.
Accept input from stdin, with a file option if appropriate.
Preserve the existing item ID and Proton Pass revision history.
Support the existing --vault-name, --share-id, --item-id, and
--item-title selectors.
Do not echo secret input in normal output or errors.
Return a nonzero exit code without partially updating the item when input is
invalid.
Document the secure automation pattern alongside item create
--from-template -.

This would make the CLI's update workflow consistent with its existing secure
creation workflow and allow automated secret rotation without accepting process
argument exposure.