Refuse config keys that no setting has (closes #419)

config.Parse walks the file as written and fails on the first key that
matches no setting, naming its dotted path and line, so a typo in
exclude or prune_grace_period no longer falls back silently. Keys that a
${...} reference brings in are checked once smartconfig has filled it
in, and named without a line. YAML merge keys and a top-level env
section, which smartconfig reads, still load; an anchor that contains
itself is an error, and each anchored map is checked once per type.
config set refuses such a key before writing, with the same error, and
sets a key under env like any other value. The key-to-field lookup
moves from internal/cli to config.SettingType so both use it.

Model: opus-5-5

README.md

@@ -313,12 +313,10 @@ when the next path element is a number (so
 `vaultik config set age_recipients.0 age1...` works on a file without
 `age_recipients`), otherwise as a map. If the config loads, a change after which
 it would not, such as `vaultik config set compression_level 99`, is refused and
-the file is left unchanged. A config that does not load, such as the one
-`config init` writes before `storage_url` is set or one with a `${ENV:...}`
-reference to a variable not set in this shell, is checked one setting at a time:
-only a change after which the changed setting cannot be read, such as one giving
-it the wrong type (a single value where a list belongs or a word where a number
-belongs), is refused.
+the file is left unchanged. A config that does not load is checked one setting
+at a time. Examples are the file `config init` writes before `storage_url` is
+set, and one with a `${ENV:...}` reference to a variable not set in this shell.
+In such a config, an unknown key or a value of the wrong type is refused.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.