Say what each command needs in --help and config.example.yml

snapshot verify --help now says --deep needs the age private key, from
VAULTIK_AGE_SECRET_KEY or age_secret_key, as snapshot restore does.
Both now name the config key as well as the environment variable.

The help of snapshot create, list, purge, remove, prune, remote info
and remote nuke says which access to the destination it needs.
config.example.yml gains age_secret_key, and no longer tells the reader
to pipe age-keygen into grep, which discards the private key.

Only help strings and comments change.

Model: fable-5-1

internal/cli/snapshot_restore.go

@@ -37,13 +37,21 @@ The snapshot may be named by its ID or, when restoring on a host with no
 local index, by the remote key that 'snapshot list' prints for a
 remote-only snapshot (an unambiguous leading part is enough).
 
-Requires the age private key in the VAULTIK_AGE_SECRET_KEY environment
-variable. The variable may hold the whole age-keygen file (comments and
-all of its identities are accepted); read it from the file rather than
-typing the key, so it does not land in your shell history:
+Each file is restored under its original absolute path inside the target
+directory. File owners are restored only when the command runs as root.
+
+Requires the age private key, in the VAULTIK_AGE_SECRET_KEY environment
+variable or as age_secret_key in the config file; the environment
+variable wins. The variable may hold the whole age-keygen file (comments
+and all of its identities are accepted); read it from the file rather
+than typing the key, so it does not land in your shell history:
 
   export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
 
+Also needs permission to read the backup destination store (and to list
+it when a remote key is given), and free space in the temporary directory
+for the decrypted blobs.
+
 Examples:
   # Restore entire snapshot
   vaultik snapshot restore myhost_docs_2025-01-01T12:00:00Z /restore