Load a config that has no age recipient (closes #221)

The README's steps for restoring on another machine failed at the first
command: `config init` wrote a placeholder recipient, and `config.Load`
rejects any recipient that does not parse. `config init` now writes an
empty `age_recipients` list, `config.Load` accepts an empty list, and
`snapshot create` refuses to start without a recipient. A malformed
recipient is still rejected at load.

The recovery-host test now builds its config with `config init` and
`config set` and reads it through `config.Load`, so it imports
`internal/cli`. On a fresh file, `config set age_recipients.0` writes the
list in flow style (`[age1...]`).

Model: opus-5-5

internal/vaultik/snapshot.go

@@ -23,6 +23,9 @@ var (
 	errSnapshotVerifyFailed = errors.New("verification failed")
 	errRemoveAllNeedsForce  = errors.New("--all requires --force")
 	errInvalidTableName     = errors.New("invalid table name")
+	errNoAgeRecipients      = errors.New(
+		"creating a snapshot needs at least one public key in " +
+			"age_recipients (generate a keypair with: age-keygen)")
 )
 
 // listRecentLimit caps how many snapshot rows are fetched from the
@@ -42,6 +45,12 @@ type SnapshotCreateOptions struct {
 
 // CreateSnapshot executes the snapshot creation operation
 func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {
+	// config.Load accepts an empty list, since listing, verifying and
+	// restoring need no public key.
+	if len(v.Config.AgeRecipients) == 0 {
+		return errNoAgeRecipients
+	}
+
 	overallStartTime := time.Now()
 
 	log.Info("Starting snapshot creation",