fix: Use vault metadata derivation index for environment mnemonic - Fixed bug where GetValue() used hardcoded index 0 instead of vault metadata - Added test31 to verify environment mnemonic respects vault derivation index - Rewrote test19DisasterRecovery to actually test manual recovery process - Removed all test skip statements as requested

internal/secret/secret.go

@@ -1,6 +1,7 @@
 package secret
 
 import (
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"os"
@@ -115,8 +116,35 @@ func (s *Secret) GetValue(unlocker Unlocker) ([]byte, error) {
 	if envMnemonic := os.Getenv(EnvMnemonic); envMnemonic != "" {
 		Debug("Using mnemonic from environment for direct long-term key derivation", "secret_name", s.Name)
 
-		// Use mnemonic directly to derive long-term key
-		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0)
+		// Get vault directory to read metadata
+		vaultDir, err := s.vault.GetDirectory()
+		if err != nil {
+			Debug("Failed to get vault directory", "error", err, "secret_name", s.Name)
+			return nil, fmt.Errorf("failed to get vault directory: %w", err)
+		}
+
+		// Load vault metadata to get the correct derivation index
+		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
+		metadataBytes, err := afero.ReadFile(s.vault.GetFilesystem(), metadataPath)
+		if err != nil {
+			Debug("Failed to read vault metadata", "error", err, "path", metadataPath)
+			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
+		}
+
+		var metadata VaultMetadata
+		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
+			Debug("Failed to parse vault metadata", "error", err, "secret_name", s.Name)
+			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
+		}
+
+		DebugWith("Using vault derivation index from metadata",
+			slog.String("secret_name", s.Name),
+			slog.String("vault_name", s.vault.GetName()),
+			slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
+		)
+
+		// Use mnemonic with the vault's derivation index from metadata
+		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
 		if err != nil {
 			Debug("Failed to derive long-term key from mnemonic for secret", "error", err, "secret_name", s.Name)
 			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)