Refuse to create a vault that already exists (closes #74)

vault.CreateVault now checks for the vault before writing anything and
fails with "vault NAME already exists" (vault.ErrVaultExists). secret
init and secret vault create call it while holding the state directory
lock, so two creates at once cannot both pass the check. Before, either
command over an existing vault replaced its metadata, passphrase
unlocker and longterm.age, so none of its secrets could be decrypted.

Both commands now ask for the unlocker passphrase before creating the
vault, so one stopped at that prompt leaves no vault without an
unlocker behind, which they would then refuse to create again.

The lock tests set up the vault "work" instead of "default", which init
now refuses to create again.

Model: opus-5-5

internal/cli/create_vault_test.go

@@ -18,6 +18,8 @@ import (
 // vault, replaced that vault's keys, so that none of its secrets could be
 // decrypted any more. Each must refuse, change nothing, and leave every
 // vault's secret readable through its passphrase unlocker.
+//
+//nolint:paralleltest // t.Setenv forbids parallel subtests
 func TestCreateExistingVaultChangesNothing(t *testing.T) {
 	t.Setenv(secret.EnvMnemonic, testMnemonic)
 	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
@@ -96,6 +98,8 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 // `secret vault create` stopped at the passphrase prompt left a vault with
 // no unlocker, which neither command would then create again. Each must ask
 // for the passphrase before writing anything.
+//
+//nolint:paralleltest // t.Setenv forbids parallel subtests
 func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 	t.Setenv(secret.EnvMnemonic, testMnemonic)