List remote snapshots without requiring the private key (closes #64)

ListSnapshots built its table entirely from the local SQLite index. The
only remote access, reportRemoteDrift, was gated on AgeSecretKey != "",
so on a correctly configured host - which by design holds no private key
- snapshot list never contacted the destination store at all. A user who
lost their local index could not see their own backups, and the
"<remote only>" cell the README documents was unreachable dead code.

The listing is now the union of the local index and the destination
store, with no age_secret_key gate. Remote-only snapshots cannot have
their hostname or name recovered - RemoteSnapshotKey is one-way and the
manifest stores the hash - so they are listed by abbreviated remote key
with the real timestamp and compressed size from the manifest, and
"<remote only>" in the two columns that require the local index. Nothing
new is written to remote storage and the human ID is never fabricated.

An unreachable destination degrades to local-only with a warning and a
zero exit code. remote_present is null rather than false in that case,
so "absent" and "unknown" stay distinguishable and no drift is claimed
from a listing that never happened.

Also:

- Snapshot timestamps are normalised to UTC in scanSnapshotRows, the
  single point where they enter the domain. Previously one of three
  scanners omitted .UTC(), so on a non-UTC host the same snapshot
  rendered a different time depending on whether it was locally tracked.
- The 1000-row cap and the unreadable-manifest count are reported in
  --json mode as well as table mode, so machine consumers cannot be
  silently truncated. The JSON shape is unchanged.
- Warnings raised while listing are routed to stderr rather than the
  logger, which writes to stdout and would corrupt the JSON document.
  This is a local workaround for the logger bug tracked in #82 and
  should be removed when that lands.
- downloadManifestByKey is now the only remote manifest reader, so the
  manifest privacy question in #81 has a single call site to change.
- The orphaned "vaultik snapshot cleanup" hint now names vaultik prune;
  that command was folded into prune by the 2026-07-02 consolidation.

README.md

@@ -175,12 +175,40 @@ needed.
 * `--keep-newer-than <duration>`: With `--prune`, keep snapshots newer than
   this duration instead of only the latest (e.g. `4w`, `30d`, `6mo`, `1y`)
 
-**`snapshot list`**: Show every snapshot known to the destination
-store with timestamps and three sizes per snapshot (compressed
-remote size; total uncompressed chunk size; size of chunks newly
-referenced by that snapshot). The uncompressed and "new chunk"
-columns show `<remote only>` for snapshots not in the local index.
-* `--json`: Output in JSON format
+**`snapshot list`**: Show every snapshot known to this host — the union
+of the local index and the backup destination store — with timestamps
+and three sizes per snapshot (compressed remote size; total
+uncompressed chunk size; size of chunks newly referenced by that
+snapshot).
+
+Listing the destination store does **not** require the age secret key,
+so it works in vaultik's intended configuration, where the backed-up
+host holds only the public key. A host that has lost its local index
+can still see what it has backed up.
+
+What that host cannot see is a remote-only snapshot's name. The
+snapshot ID is hashed at the storage boundary and the manifest records
+only the hash, so hostname and snapshot name exist solely in the local
+index and in the encrypted per-snapshot database. Snapshots found only
+on the destination store are therefore listed as
+`<remote only:<abbreviated remote key>>` and show `<remote only>` in
+the uncompressed and "new chunk" columns, which can only be computed
+from the local index. Their timestamp and compressed size are real,
+read from the manifest.
+
+Snapshots in the local index with no counterpart on the destination
+store are reported below the table as drift, with the `vaultik prune`
+invocation that reconciles them.
+
+If the destination store cannot be listed (unmounted volume,
+permission denied, network down), the command warns, falls back to the
+local index alone, and still exits zero.
+* `--json`: Output in JSON format. Each entry carries `locally_tracked`
+  (whether the snapshot is in the local index), `remote_key` (the full
+  64-character storage key), and `remote_present` (whether it was seen
+  on the destination store, or `null` if the destination could not be
+  listed). The warning about an unlistable destination goes to stderr
+  so stdout stays a single parseable document.
 
 **`snapshot verify`**: Verify snapshot integrity.
 * Default (shallow): checks that all blobs referenced in the manifest exist in storage