Refuse a relative index_path at config load (closes #430)

A relative index_path resolved against the working directory, so a
backup run from another directory started from an empty index. Validate
now refuses it, naming the value, with the same wording as the file://
storage_url check. ~ is still expanded first. The check sees the final
value, so a relative VAULTIK_INDEX_PATH is refused too; an explicitly
empty index_path is refused as well.

Model: opus-5-5

internal/config/config.go

@@ -70,6 +70,9 @@ var (
 	errFileURLNotAbsolute = errors.New(
 		"a file:// storage_url needs an absolute path, " +
 			"as in file:///path/to/backup")
+	errIndexPathNotAbsolute = errors.New(
+		"index_path and VAULTIK_INDEX_PATH need an absolute path, " +
+			"as in ~/.local/share/vaultik/index.sqlite")
 	errNegativePruneGracePeriod = errors.New(
 		"prune_grace_period must not be negative")
 	errStorageNotConfigured = errors.New(
@@ -387,6 +390,8 @@ func Parse(data []byte) (*Config, error) {
 //     create needs a recipient and it checks for one itself
 //   - At least one snapshot must be configured with at least one path
 //   - Storage must be configured (either storage_url or s3.* fields)
+//   - The index path must be absolute: a relative one would resolve against
+//     the working directory, so each directory would get its own index
 //   - Chunk size must be at least 1MB
 //   - Blob size limit must be at least the largest chunk the chunker can emit
 //     (chunk_size times chunker.ChunkSizeSpread), so a single-chunk blob never
@@ -420,6 +425,10 @@ func (c *Config) Validate() error {
 		return err
 	}
 
+	if !filepath.IsAbs(c.IndexPath) {
+		return fmt.Errorf("%w: %q", errIndexPathNotAbsolute, c.IndexPath)
+	}
+
 	if c.ChunkSize.Int64() < minChunkSize {
 		return errChunkSizeTooSmall
 	}