Refuse config keys that no setting has (closes #419)

config.Parse walks the file as written and fails on the first key that
matches no setting, naming its dotted path and line, so a typo in
exclude or prune_grace_period no longer falls back silently. ${...}
references and YAML merge keys still load. config set refuses such a key
before writing. The key-to-field lookup moves from internal/cli to
config.SettingType so both use it.

Model: opus-5-5

README.md

@@ -311,14 +311,15 @@ existing file. Created with mode `0600` since it will contain credentials.
 in the file are preserved. Missing keys along the path are created: as a list
 when the next path element is a number (so
 `vaultik config set age_recipients.0 age1...` works on a file without
-`age_recipients`), otherwise as a map. If the config loads, a change after which
-it would not, such as `vaultik config set compression_level 99`, is refused and
-the file is left unchanged. A config that does not load, such as the one
-`config init` writes before `storage_url` is set or one with a `${ENV:...}`
-reference to a variable not set in this shell, is checked one setting at a time:
-only a change after which the changed setting cannot be read, such as one giving
-it the wrong type (a single value where a list belongs or a word where a number
-belongs), is refused.
+`age_recipients`), otherwise as a map. A key that no setting has, such as a
+misspelled one, is refused. If the config loads, a change after which it would
+not, such as `vaultik config set compression_level 99`, is refused and the file
+is left unchanged. A config that does not load, such as the one `config init`
+writes before `storage_url` is set or one with a `${ENV:...}` reference to a
+variable not set in this shell, is checked one setting at a time: a change after
+which the changed setting cannot be read, such as one giving it the wrong type
+(a single value where a list belongs or a word where a number belongs), is
+refused.
 
 **`snapshot create`**: Perform incremental backup of configured snapshots.