Exit 1 when a deletion prompt is not confirmed (closes #423)

`prune`, `snapshot purge`, `snapshot remove` and `database delete`
printed "Cancelled" or "Aborted." and exited 0 when the prompt was
answered no or stdin ended. They now return vaultik.ErrNotConfirmed,
so the command reports "deletion not confirmed" and exits 1.

`database delete` reads its answer from the command's stdin instead of
os.Stdin, so a test can supply it.

Model: opus-5-5

internal/cli/database.go

@@ -7,6 +7,7 @@ import (
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/vaultik/internal/config"
 	"sneak.berlin/go/vaultik/internal/log"
+	"sneak.berlin/go/vaultik/internal/vaultik"
 )
 
 // NewDatabaseCommand creates the database command group
@@ -90,12 +91,12 @@ Use --force to skip the confirmation prompt.`,
 
 				var confirm string
 
-				_, err = fmt.Scanln(&confirm)
+				// A failure to read the answer means no confirmation.
+				_, err = fmt.Fscanln(cmd.InOrStdin(), &confirm)
 				if err != nil || confirm != "yes" {
 					_, _ = fmt.Fprintln(w, "Aborted.")
 
-					//nolint:nilerr // a failed/aborted confirmation is a clean abort
-					return nil
+					return vaultik.ErrNotConfirmed
 				}
 			}