Check vault names in every command that takes one (closes #68)

A vault name may use only lowercase ASCII letters, digits, `.`, `-` and
`_`, and must not be empty, `.` or `..`; the error now states that rule.
`vault create`, `vault import`, `vault select`, `vault remove` and both
vault names of `mv` check the name as typed before building any path
from it. Before, `vault import ..` wrote a long-term key and an unlocker
into the state directory itself, and `vault select ..` made that the
current vault.

Model: opus-5-5

internal/cli/vault.go

@@ -267,6 +267,12 @@ func resolvePassphrase() (*memguard.LockedBuffer, error) {
 func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	secret.Debug("Creating new vault", "name", name, "state_dir", cli.stateDir)
 
+	// vault.CreateVault checks the name too, but only after the prompts below.
+	err := vault.ValidateVaultName(name)
+	if err != nil {
+		return err
+	}
+
 	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
 	if err != nil {
 		return err
@@ -477,6 +483,11 @@ func (cli *Instance) importMnemonic(cmd *cobra.Command, vaultName string) error
 	secret.Debug("Importing mnemonic into vault",
 		"vault_name", vaultName, "state_dir", cli.stateDir)
 
+	err := vault.ValidateVaultName(vaultName)
+	if err != nil {
+		return err
+	}
+
 	// Get the specific vault by name
 	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
 
@@ -628,6 +639,11 @@ func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) er
 
 // removeVault removes a vault with safety checks
 func (cli *Instance) removeVault(cmd *cobra.Command, name string, force bool) error {
+	err := vault.ValidateVaultName(name)
+	if err != nil {
+		return err
+	}
+
 	// Get list of all vaults
 	vaults, err := vault.ListVaults(cli.fs, cli.stateDir)
 	if err != nil {