Print startup banner on every invocation (except -q / --cron)

Adds maybePrintBanner() called from three cobra hooks:
  - PersistentPreRun on root: covers every subcommand invocation
  - Custom HelpFunc on root: covers --help and group-level help
  - Run on root: covers bare 'vaultik' with no subcommand

bannerOnce sync.Once ensures the banner prints exactly once per
process regardless of which hook(s) fire.

Removed the duplicate banner-print from fx setupGlobals; that hook
still handles the --cron/--quiet UI swap for the rest of the output.

internal/cli/app.go

@@ -35,18 +35,16 @@ type AppOptions struct {
 	Invokes    []fx.Option
 }
 
-// setupGlobals records the startup time and prints the startup banner.
-// In --cron mode the banner is suppressed (LogOptions.Cron == true).
+// setupGlobals records the startup time and, when an output-suppression
+// flag is active, replaces the UI writer with a discarding one so no
+// user-facing output is emitted. The startup banner itself is printed
+// by the root command's PersistentPreRun (see maybePrintBanner).
 func setupGlobals(lc fx.Lifecycle, g *globals.Globals, v *vaultik.Vaultik, opts log.LogOptions) {
 	lc.Append(fx.Hook{
 		OnStart: func(ctx context.Context) error {
 			g.StartTime = time.Now().UTC()
 			if opts.Cron || opts.Quiet {
-				// Replace UI writer with a discarding one so all
-				// user-facing output is suppressed.
 				v.UI = ui.NewWithColor(io.Discard, false)
-			} else {
-				writeStartupBanner(v.UI, g.StartTime, g.ShortCommit())
 			}
 			return nil
 		},