List remote snapshots without requiring the private key (closes #64)

ListSnapshots built its table entirely from the local SQLite index. The
only remote access, reportRemoteDrift, was gated on AgeSecretKey != "",
so on a correctly configured host - which by design holds no private key
- snapshot list never contacted the destination store at all. A user who
lost their local index could not see their own backups, and the
"<remote only>" cell the README documents was unreachable dead code.

The listing is now the union of the local index and the destination
store, with no age_secret_key gate. Remote-only snapshots cannot have
their hostname or name recovered - RemoteSnapshotKey is one-way and the
manifest stores the hash - so they are listed by abbreviated remote key
with the real timestamp and compressed size from the manifest, and
"<remote only>" in the two columns that require the local index. Nothing
new is written to remote storage and the human ID is never fabricated.

An unreachable destination degrades to local-only with a warning and a
zero exit code. remote_present is null rather than false in that case,
so "absent" and "unknown" stay distinguishable and no drift is claimed
from a listing that never happened.

Also:

- Snapshot timestamps are normalised to UTC in scanSnapshotRows, the
  single point where they enter the domain. Previously one of three
  scanners omitted .UTC(), so on a non-UTC host the same snapshot
  rendered a different time depending on whether it was locally tracked.
- The 1000-row cap and the unreadable-manifest count are reported in
  --json mode as well as table mode, so machine consumers cannot be
  silently truncated. The JSON shape is unchanged.
- Warnings raised while listing are routed to stderr rather than the
  logger, which writes to stdout and would corrupt the JSON document.
  This is a local workaround for the logger bug tracked in #82 and
  should be removed when that lands.
- downloadManifestByKey is now the only remote manifest reader, so the
  manifest privacy question in #81 has a single call site to change.
- The orphaned "vaultik snapshot cleanup" hint now names vaultik prune;
  that command was folded into prune by the 2026-07-02 consolidation.

internal/vaultik/info.go

@@ -9,7 +9,6 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"sneak.berlin/go/vaultik/internal/log"
-	"sneak.berlin/go/vaultik/internal/snapshot"
 )
 
 // ShowInfo displays system and configuration information
@@ -312,20 +311,12 @@ func (v *Vaultik) collectReferencedBlobsFromManifests(
 	referencedBlobs := make(map[string]int64)
 
 	for _, snapshotID := range snapshotIDs {
-		manifestKey := fmt.Sprintf("metadata/%s/manifest.json.zst", snapshotID)
-
-		reader, err := v.Storage.Get(v.ctx, manifestKey)
+		// snapshotIDs here are remote keys, taken straight from the
+		// metadata/ listing. downloadManifestByKey is the single reader
+		// for remote manifests; see its doc comment.
+		manifest, err := v.downloadManifestByKey(snapshotID)
 		if err != nil {
-			log.Warn("Failed to get manifest", "snapshot", snapshotID, "error", err)
-
-			continue
-		}
-
-		manifest, err := snapshot.DecodeManifest(reader)
-		_ = reader.Close()
-
-		if err != nil {
-			log.Warn("Failed to decode manifest", "snapshot", snapshotID, "error", err)
+			log.Warn("Failed to read manifest", "snapshot", snapshotID, "error", err)
 
 			continue
 		}