Add blob manifest for pruning without decryption

- Update bucket structure to include unencrypted blob manifest files
- Add <snapshot_id>.manifest.json.zst containing list of referenced blobs
- This enables pruning operations without requiring decryption keys
- Add snapshot management commands: list, rm, latest (stubs)
- Add --prune flag to backup command for automatic cleanup
- Update DESIGN.md to document manifest format and updated prune flow

internal/cli/backup.go

@@ -17,6 +17,7 @@ type BackupOptions struct {
 	ConfigPath string
 	Daemon     bool
 	Cron       bool
+	Prune      bool
 }
 
 // NewBackupCommand creates the backup command
@@ -52,6 +53,7 @@ a path using --config or by setting VAULTIK_CONFIG to a path.`,
 	cmd.Flags().StringVar(&opts.ConfigPath, "config", "", "Path to config file")
 	cmd.Flags().BoolVar(&opts.Daemon, "daemon", false, "Run in daemon mode with inotify monitoring")
 	cmd.Flags().BoolVar(&opts.Cron, "cron", false, "Run in cron mode (silent unless error)")
+	cmd.Flags().BoolVar(&opts.Prune, "prune", false, "Delete all previous snapshots and unreferenced blobs after backup")
 
 	return cmd
 }
@@ -71,6 +73,9 @@ func runBackup(ctx context.Context, opts *BackupOptions) error {
 				if opts.Cron {
 					fmt.Println("Running in cron mode")
 				}
+				if opts.Prune {
+					fmt.Println("Pruning enabled - will delete old snapshots after backup")
+				}
 				return nil
 			}),
 		},

internal/cli/root.go

@@ -22,6 +22,7 @@ on the source system.`,
 		NewPruneCommand(),
 		NewVerifyCommand(),
 		NewFetchCommand(),
+		SnapshotCmd(),
 	)
 
 	return cmd

internal/cli/snapshot.go

@@ -0,0 +1,90 @@
+package cli
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func SnapshotCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "snapshot",
+		Short: "Manage snapshots",
+		Long:  "Commands for listing, removing, and querying snapshots",
+	}
+
+	cmd.AddCommand(snapshotListCmd())
+	cmd.AddCommand(snapshotRmCmd())
+	cmd.AddCommand(snapshotLatestCmd())
+
+	return cmd
+}
+
+func snapshotListCmd() *cobra.Command {
+	var (
+		bucket string
+		prefix string
+		limit  int
+	)
+
+	cmd := &cobra.Command{
+		Use:   "list",
+		Short: "List snapshots",
+		Long:  "List all snapshots in the bucket, sorted by timestamp",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			panic("unimplemented")
+		},
+	}
+
+	cmd.Flags().StringVar(&bucket, "bucket", "", "S3 bucket name")
+	cmd.Flags().StringVar(&prefix, "prefix", "", "S3 prefix")
+	cmd.Flags().IntVar(&limit, "limit", 10, "Maximum number of snapshots to list")
+	cmd.MarkFlagRequired("bucket")
+
+	return cmd
+}
+
+func snapshotRmCmd() *cobra.Command {
+	var (
+		bucket   string
+		prefix   string
+		snapshot string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "rm",
+		Short: "Remove a snapshot",
+		Long:  "Remove a snapshot and optionally its associated blobs",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			panic("unimplemented")
+		},
+	}
+
+	cmd.Flags().StringVar(&bucket, "bucket", "", "S3 bucket name")
+	cmd.Flags().StringVar(&prefix, "prefix", "", "S3 prefix")
+	cmd.Flags().StringVar(&snapshot, "snapshot", "", "Snapshot ID to remove")
+	cmd.MarkFlagRequired("bucket")
+	cmd.MarkFlagRequired("snapshot")
+
+	return cmd
+}
+
+func snapshotLatestCmd() *cobra.Command {
+	var (
+		bucket string
+		prefix string
+	)
+
+	cmd := &cobra.Command{
+		Use:   "latest",
+		Short: "Get the latest snapshot ID",
+		Long:  "Display the ID of the most recent snapshot",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			panic("unimplemented")
+		},
+	}
+
+	cmd.Flags().StringVar(&bucket, "bucket", "", "S3 bucket name")
+	cmd.Flags().StringVar(&prefix, "prefix", "", "S3 prefix")
+	cmd.MarkFlagRequired("bucket")
+
+	return cmd
+}