Fix --cron silence, add snapshot cleanup, fix .gitignore

--cron now sets Vaultik.Stdout to io.Discard so all user-facing output
is suppressed, not just the scanner progress. Errors still go to stderr
via the structured logger.

snapshot list now warns when local snapshot records have no matching
remote metadata, and suggests 'vaultik snapshot cleanup' instead of
silently deleting them.

snapshot cleanup is a new subcommand that explicitly removes stale
local snapshot records. syncWithRemote (used by purge) still does
this automatically since purge is already destructive.

.gitignore changed from 'vaultik' to '/vaultik' so it only matches
the binary at the repo root, not the internal/vaultik/ directory.

README.md

@@ -120,6 +120,7 @@ vaultik [--config <path>] snapshot verify <snapshot-id> [--deep] [--json]
 vaultik [--config <path>] snapshot purge [--keep-latest | --older-than <duration>] [--snapshot <name>...] [--force]
 vaultik [--config <path>] snapshot remove <snapshot-id|--all> [--dry-run] [--force] [--remote] [--json]
 vaultik [--config <path>] snapshot prune
+vaultik [--config <path>] snapshot cleanup
 vaultik [--config <path>] restore <snapshot-id> <target-dir> [paths...] [--verify]
 vaultik [--config <path>] prune [--force] [--json]
 vaultik [--config <path>] info
@@ -181,6 +182,10 @@ latest globally).
 **snapshot prune**: Clean orphaned data from the local database (files,
 chunks, blobs not referenced by any snapshot).
 
+**snapshot cleanup**: Remove stale local snapshot records that have no
+corresponding metadata in remote storage. These are typically left behind
+by incomplete or interrupted backups. Does not touch remote storage.
+
 **restore**: Restore files from a backup snapshot.
 * Requires `VAULTIK_AGE_SECRET_KEY` environment variable
 * Optional path arguments to restore specific files/directories (default: all)