Add exclude patterns, snapshot prune, and other improvements

- Implement exclude patterns with anchored pattern support:
  - Patterns starting with / only match from root of source dir
  - Unanchored patterns match anywhere in path
  - Support for glob patterns (*.log, .*, **/*.pack)
  - Directory patterns skip entire subtrees
  - Add gobwas/glob dependency for pattern matching
  - Add 16 comprehensive tests for exclude functionality

- Add snapshot prune command to clean orphaned data:
  - Removes incomplete snapshots from database
  - Cleans orphaned files, chunks, and blobs
  - Runs automatically at backup start for consistency

- Add snapshot remove command for deleting snapshots

- Add VAULTIK_AGE_SECRET_KEY environment variable support

- Fix duplicate fx module provider in restore command

- Change snapshot ID format to hostname_YYYY-MM-DDTHH:MM:SSZ

TODO.md

@@ -40,6 +40,28 @@ Reorganize commands to provide better visibility into stored data and snapshots.
   - `--deep` mode: Downloads each blob and verifies its hash matches the stored hash
   - **Stub implementation for now**
 
+- `vaultik snapshot remove <snapshot-id>` (alias: `rm`)
+  - Removes a snapshot and any blobs that become orphaned
+  - Algorithm:
+    1. Validate target snapshot exists in storage
+    2. List all snapshots in storage
+    3. Download manifests from all OTHER snapshots to build "in-use" blob set
+    4. Download target snapshot's manifest to get its blob hashes
+    5. Identify orphaned blobs: target blobs NOT in the in-use set
+    6. Delete orphaned blobs from storage
+    7. Delete snapshot metadata using existing `deleteSnapshot()` helper
+  - Flags:
+    - `--force` / `-f`: Skip confirmation prompt
+    - `--dry-run`: Show what would be deleted without deleting
+  - Files to modify:
+    - `internal/cli/snapshot.go`: Add `newSnapshotRemoveCommand()`
+    - `internal/vaultik/snapshot.go`: Add `RemoveSnapshot()` method
+  - Reuse existing code:
+    - Snapshot enumeration pattern from `PruneBlobs()` in `prune.go`
+    - `v.downloadManifest(snapshotID)` for manifest downloading
+    - Blob path format: `blobs/{hash[:2]}/{hash[2:4]}/{hash}`
+    - `v.deleteSnapshot(snapshotID)` for metadata deletion
+
 ### Implementation Notes
 
 1. **No Decryption Required**: All commands work with unencrypted blob manifests