Use one duration parser and fix the --older-than months example (closes #123)

Two functions named parseDuration existed with different grammars. --older-than and --keep-newer-than both already parsed through the one in internal/vaultik; the richer copy in internal/cli/duration.go was reachable only from its own test. Kept the live-path parser and deleted the unused one, so no flag's accepted grammar changes. README documented 6m as the months example for --older-than, but m is minutes, so that command deleted every snapshot older than six minutes; corrected it to 6mo and put both flags' help on one example list stating m is minutes and mo is months. The parser now rejects negatives it used to accept (-5h) or silently made positive (-5d).

Model: opus-4-8

TODO.md

@@ -50,6 +50,24 @@ release" is exactly the contradiction
   keeps that exact compiler from auto-switching. Bumping Go now touches
   `go.mod`, the checksum, and the `Dockerfile` `golang` digest together.
 
+- 2026-09-21: Collapsed the two duration parsers into one and fixed the
+  `--older-than` months example
+  ([issue #123](https://git.eeqj.de/sneak/vaultik/issues/123)). Two
+  functions named `parseDuration` existed with different grammars;
+  `snapshot purge --older-than` and `--keep-newer-than` both already went
+  through the one in `internal/vaultik`, while the richer copy in
+  `internal/cli/duration.go` was reachable only from its own test. Kept
+  the live-path parser and deleted the unused one, so no flag's accepted
+  grammar changes. The trap the issue was filed over: `README.md`
+  documented `6m` as the months example for `--older-than`, but `m` is
+  minutes, so the documented command deleted every snapshot older than
+  six minutes on a destructive flag. Corrected the doc to `6mo` and put
+  both flags' help text on one example list that states `m` is minutes
+  and `mo` is months. The surviving parser now rejects negatives, which
+  it previously accepted (`-5h`) or silently made positive (`-5d`).
+  Table-driven tests cover every unit, `6m` as six minutes, `6mo` as 180
+  days, and rejection of a bare number, an unknown unit, and a negative.
+
 - 2026-08-10: Moved every lint run into its own container, as a build
   step ([issue #113](https://git.eeqj.de/sneak/vaultik/issues/113)).
   New root `Dockerfile.lint`, built by `script/lint`, runs