Add snapshot files to list a snapshot's files without restoring it (closes #435)

`vaultik snapshot files <snapshot-id> [path] [--json]` downloads and
decrypts the snapshot database, as restore does, and prints mode, size,
modification time and path for every file at or under the path. A path
that matches nothing is an error. It needs the private key. The mode is
in Go's file-mode notation, which the README spells out. The table
quotes a path that holds a non-printable character.

Named `files` because `ls` is already the alias of `snapshot list`.
The missing-key error no longer says "for restore", since this command
and deep verify return it too. The README opening now states the
private-key rule first.

Model: opus-5-5

docs/REPOSTRUCTURE.md

@@ -265,15 +265,23 @@ so an operator can weigh them rather than discover them.
    blob holds hundreds of chunks, so individual chunk lengths are not visible in
    the blob's size; lowering the limit toward the chunk size begins to expose
    them.
-4. **Decrypted data on local disk.** Several commands stage plaintext under
-   `$TMPDIR`: `snapshot restore` writes decrypted blobs under
-   `vaultik-blobcache-*/` (no size cap) and the decrypted metadata database at
-   `vaultik-restore-*/snapshot.db`; `verify --deep` writes that database at
-   `vaultik-verify-*/snapshot.db`; `snapshot create` keeps a plaintext copy of
-   the index at `vaultik-snapshot-*/snapshot.db`. These files are created `0600`
-   and removed on success, but a `kill -9` or a power loss leaves them behind —
-   delete any leftover `vaultik-*` directory under `$TMPDIR` by hand. `$TMPDIR`
-   should be trusted to the same degree as the restore target.
+4. **Decrypted data on local disk.** These commands stage plaintext under
+   `$TMPDIR`:
+    - `snapshot restore`: decrypted blobs under `vaultik-blobcache-*/`, with no
+      size cap, and the decrypted metadata database at
+      `vaultik-restore-*/snapshot.db`.
+    - `snapshot files`: the decrypted metadata database at
+      `vaultik-restore-*/snapshot.db`.
+    - `verify --deep`: the decrypted metadata database at
+      `vaultik-verify-*/snapshot.db`.
+    - `snapshot create`: a plaintext copy of the index at
+      `vaultik-snapshot-*/snapshot.db`.
+
+    These files are created `0600` and removed on success, but a `kill -9` or a
+    power loss leaves them behind — delete any leftover `vaultik-*` directory
+    under `$TMPDIR` by hand. `$TMPDIR` should be trusted to the same degree as
+    the restore target.
+
 5. **Store permissions differ per command.** The backed-up host needs only PUT
    to run `snapshot create`: it writes blobs and metadata and neither reads nor
    deletes them. Other commands need more — `snapshot verify`,