Parse age_recipients at config load and never echo the entry (closes #153)

Config.Validate now parses every age_recipients entry with age.ParseX25519Recipient, so a bad recipient fails at config load instead of deep in a backup after the snapshot row and tree walk. On failure the error names the position (age_recipients[N]) and never the value: a recipient string can itself be a secret key an operator pasted by mistake, and age's own error quotes its input. An entry starting with AGE-SECRET-KEY- gets a specific message.

The remaining parse sites (blobgen.NewWriter, crypto NewEncryptor and UpdateRecipients), reachable by callers that skip config.Load, likewise drop the value and age's wrapped error, naming only the position.

Model: opus-4-8

internal/blobgen/writer.go

@@ -27,6 +27,11 @@ const reservedCompressionCPUs = 2
 var ErrInvalidCompressionLevel = errors.New(
 	"invalid compression level: must be between 1 and 19")
 
+// errInvalidRecipient is returned when a recipient string does not parse as
+// an X25519 age1... public key. It omits the value, which can be sensitive.
+var errInvalidRecipient = errors.New(
+	"not a valid X25519 age1... recipient")
+
 // Writer wraps compression and encryption with SHA256 hashing.
 // Data flows: input -> tee(hasher, compressor -> encryptor -> destination)
 // The hash is computed on the uncompressed input for deterministic content-addressing.
@@ -57,10 +62,12 @@ func NewWriter(
 	// Parse recipients
 	var ageRecipients []age.Recipient
 
-	for _, recipient := range recipients {
+	for i, recipient := range recipients {
+		// The recipient string can be sensitive (e.g. a secret key pasted by
+		// mistake), so the error names its position, never its value.
 		r, err := age.ParseX25519Recipient(recipient)
 		if err != nil {
-			return nil, fmt.Errorf("parsing recipient %s: %w", recipient, err)
+			return nil, fmt.Errorf("%w: recipient %d", errInvalidRecipient, i)
 		}
 
 		ageRecipients = append(ageRecipients, r)