Return error from GetDefaultStateDir when home directory unavailable

When os.UserConfigDir() fails, DetermineStateDir falls back to
os.UserHomeDir(). Previously the error from UserHomeDir was discarded,
which could result in a dangerous root-relative path (/.config/...) if
both calls fail.

Now DetermineStateDir returns (string, error) and propagates failures
from both UserConfigDir and UserHomeDir.

Closes #14

internal/cli/cli.go

@@ -19,7 +19,10 @@ type Instance struct {
 // NewCLIInstance creates a new CLI instance with the real filesystem
 func NewCLIInstance() *Instance {
 	fs := afero.NewOsFs()
-	stateDir := secret.DetermineStateDir("")
+	stateDir, err := secret.DetermineStateDir("")
+	if err != nil {
+		panic(fmt.Sprintf("cannot determine state directory: %v", err))
+	}
 
 	return &Instance{
 		fs:       fs,
@@ -29,7 +32,10 @@ func NewCLIInstance() *Instance {
 
 // NewCLIInstanceWithFs creates a new CLI instance with the given filesystem (for testing)
 func NewCLIInstanceWithFs(fs afero.Fs) *Instance {
-	stateDir := secret.DetermineStateDir("")
+	stateDir, err := secret.DetermineStateDir("")
+	if err != nil {
+		panic(fmt.Sprintf("cannot determine state directory: %v", err))
+	}
 
 	return &Instance{
 		fs:       fs,

internal/cli/cli_test.go

@@ -41,7 +41,10 @@ func TestDetermineStateDir(t *testing.T) {
 	testEnvDir := "/test-env-dir"
 	t.Setenv(secret.EnvStateDir, testEnvDir)
 
-	stateDir := secret.DetermineStateDir("")
+	stateDir, err := secret.DetermineStateDir("")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
 	if stateDir != testEnvDir {
 		t.Errorf("Expected state directory %q from environment, got %q", testEnvDir, stateDir)
 	}
@@ -49,7 +52,10 @@ func TestDetermineStateDir(t *testing.T) {
 	// Test with custom config dir
 	_ = os.Unsetenv(secret.EnvStateDir)
 	customConfigDir := "/custom-config"
-	stateDir = secret.DetermineStateDir(customConfigDir)
+	stateDir, err = secret.DetermineStateDir(customConfigDir)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
 	expectedDir := filepath.Join(customConfigDir, secret.AppID)
 	if stateDir != expectedDir {
 		t.Errorf("Expected state directory %q with custom config, got %q", expectedDir, stateDir)