Load a config that has no age recipient (closes #221)

The README's steps for restoring on another machine failed at the first
command: `config init` wrote a placeholder recipient, and `config.Load`
rejects any recipient that does not parse. `config init` now writes an
empty `age_recipients` list, `config.Load` accepts an empty list, and
`snapshot create` refuses to start without a recipient. A malformed
recipient is still rejected at load.

The recovery-host test now builds its config with `config init` and
`config set` and reads it through `config.Load`, so it imports
`internal/cli`. On a fresh file, `config set age_recipients.0` writes the
list in flow style (`[age1...]`).

Model: opus-5-5

config.example.yml

@@ -3,7 +3,8 @@
 # Copy this file and uncomment/modify the values you need
 
 # Age recipient public keys for encryption
-# This is REQUIRED - backups are encrypted to these public keys
+# Backups are encrypted to these public keys. snapshot create needs at least
+# one; listing, verifying and restoring do not
 # Generate with: age-keygen | grep "public key"
 age_recipients:
   - age1cj2k2addawy294f6k2gr2mf9gps9r3syplryxca3nvxj3daqm96qfp84tz