Load a config that has no age recipient (closes #221)

The README's steps for restoring on another machine failed at the first
command: `config init` wrote a placeholder recipient, and `config.Load`
rejects any recipient that does not parse. `config init` now writes an
empty `age_recipients` list, `config.Load` accepts an empty list, and
`snapshot create` refuses to start without a recipient. A malformed
recipient is still rejected at load.

The recovery-host test now builds its config with `config init` and
`config set` and reads it through `config.Load`, so it imports
`internal/cli`. On a fresh file, `config set age_recipients.0` writes the
list in flow style (`[age1...]`).

Model: opus-5-5

TODO.md

@@ -22,6 +22,14 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-06: Made the README's steps for restoring on another machine
+  work ([issue #221](https://git.eeqj.de/sneak/vaultik/issues/221)).
+  `config init` wrote a placeholder recipient that `config.Load`
+  rejects, so every command on the new machine failed before reaching
+  the store. The file now has an empty `age_recipients` list,
+  `config.Load` accepts an empty list, and `snapshot create` refuses to
+  run without a recipient.
+
 - 2026-10-06: Made `snapshot restore --skip-errors` skip the files that
   need a blob it cannot download
   ([issue #218](https://git.eeqj.de/sneak/vaultik/issues/218)). A missing