Add blob manifest for pruning without decryption

- Update bucket structure to include unencrypted blob manifest files
- Add <snapshot_id>.manifest.json.zst containing list of referenced blobs
- This enables pruning operations without requiring decryption keys
- Add snapshot management commands: list, rm, latest (stubs)
- Add --prune flag to backup command for automatic cleanup
- Update DESIGN.md to document manifest format and updated prune flow

internal/cli/root.go

@@ -22,6 +22,7 @@ on the source system.`,
 		NewPruneCommand(),
 		NewVerifyCommand(),
 		NewFetchCommand(),
+		SnapshotCmd(),
 	)
 
 	return cmd