Add snapshot files to list a snapshot's files without restoring it (closes #435)

`vaultik snapshot files <snapshot-id> [path] [--json]` downloads and
decrypts the snapshot database, as restore does, and prints mode, size,
modification time and path for every file at or under the path. A path
that matches nothing is an error. It needs the private key. The mode is
in Go's file-mode notation, which the README spells out.

Named `files` because `ls` is already the alias of `snapshot list`.
The missing-key error no longer says "for restore", since this command
and deep verify return it too. The README opening now states the
private-key rule first.

Model: opus-5-5

internal/cli/entry_test.go

@@ -48,7 +48,7 @@ func TestCLIEntry(t *testing.T) {
 	} else {
 		// Check snapshot subcommands
 		expectedSubCommands := []string{
-			"create", "list", "purge", "verify", "remove", "restore",
+			"create", "list", "files", "purge", "verify", "remove", "restore",
 		}
 		for _, expected := range expectedSubCommands {
 			found := false