Route direct-stdout command output through internal/ui (closes #149)

version, info, remote info, config, and database delete wrote plain text
straight to stdout, so they were unstyled and ignored --quiet. Output now
falls in two buckets, both governed by internal/ui.

Status lines and confirmations (config init, config set, database
delete) go through the ui message methods: styled, and --quiet silences
them. The data a command exists to produce is written plain, since a
marker would corrupt a table or a parsed document: the version, info, and
remote info reports, the snapshot list table, config get values, and the
--json documents. --quiet silences the human reports and tables but never
the config get value or the --json documents, which a script depends on.
The database delete confirmation prompt is always shown; it is an
interactive exchange the operator must see.

The pure-cli commands reach internal/ui through a small commandUI helper
that builds a ui.Writer on the command's stdout in quiet mode when
--quiet is set. NewForTesting now supplies a UI writer so the quiet gate
is never nil. The README output-style section states the resulting rule.

Model: opus-4-8

internal/cli/config_test.go

@@ -9,6 +9,7 @@ import (
 
 	"gopkg.in/yaml.v3"
 	"sneak.berlin/go/vaultik/internal/config"
+	"sneak.berlin/go/vaultik/internal/ui"
 )
 
 // TestDefaultConfigTemplateParses ensures the init template is valid YAML
@@ -246,19 +247,20 @@ func TestWriteConfigSetHidesSecret(t *testing.T) {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	var out bytes.Buffer
+	var buf bytes.Buffer
 
-	err = writeConfigSet(&out, path, "s3.secret_access_key", secret)
+	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
+		"s3.secret_access_key", secret)
 	if err != nil {
 		t.Fatalf("writeConfigSet: %v", err)
 	}
 
-	if strings.Contains(out.String(), secret) {
-		t.Errorf("output echoed the secret value: %q", out.String())
+	if strings.Contains(buf.String(), secret) {
+		t.Errorf("output echoed the secret value: %q", buf.String())
 	}
 
-	if !strings.Contains(out.String(), "s3.secret_access_key") {
-		t.Errorf("output did not confirm the key name: %q", out.String())
+	if !strings.Contains(buf.String(), "s3.secret_access_key") {
+		t.Errorf("output did not confirm the key name: %q", buf.String())
 	}
 }
 
@@ -277,9 +279,10 @@ func TestWriteConfigSetTightensMode(t *testing.T) {
 		t.Fatalf("seed config: %v", err)
 	}
 
-	var out bytes.Buffer
+	var buf bytes.Buffer
 
-	err = writeConfigSet(&out, path, "compression_level", "9")
+	err = writeConfigSet(ui.NewWithColor(&buf, false), path,
+		"compression_level", "9")
 	if err != nil {
 		t.Fatalf("writeConfigSet: %v", err)
 	}