Load a config that has no age recipient (closes #221)

The README's steps for restoring on another machine failed at the first
command: `config init` wrote a placeholder recipient, and `config.Load`
rejects any recipient that does not parse. `config init` now writes an
empty `age_recipients` list, `config.Load` accepts an empty list, and
`snapshot create` refuses to start without a recipient. A malformed
recipient is still rejected at load.

The recovery-host test now builds its config with `config init` and
`config set` and reads it through `config.Load`, so it imports
`internal/cli`. On a fresh file, `config set age_recipients.0` writes the
list in flow style (`[age1...]`).

Model: opus-5-5

internal/config/config_test.go

@@ -223,7 +223,8 @@ func TestValidateBlobSizeLimit(t *testing.T) {
 
 // TestValidateAgeRecipients checks that recipients are parsed at config load
 // (a bad entry fails immediately, not mid-backup) and that no invalid entry —
-// least of all a pasted secret key — is echoed in the error.
+// least of all a pasted secret key — is echoed in the error. An empty list
+// loads, because only snapshot create needs a recipient.
 func TestValidateAgeRecipients(t *testing.T) {
 	t.Parallel()
 
@@ -244,7 +245,12 @@ func TestValidateAgeRecipients(t *testing.T) {
 		wantErr    bool
 	}{
 		{
-			name:       "config init placeholder is rejected",
+			name:       "no recipients is accepted",
+			recipients: nil,
+			wantErr:    false,
+		},
+		{
+			name:       "placeholder recipient is rejected",
 			recipients: []string{"age1REPLACE_WITH_YOUR_PUBLIC_KEY"},
 			wantErr:    true,
 		},