Fix two misleading messages (closes #240)

The warning for a config file that others can read always said the
file contained S3 credentials, so a file:// config with none got a
false claim. It now names them only when s3.access_key_id or
s3.secret_access_key is set, and otherwise says the file is readable
by others.

snapshot purge wrapped the listing error, which already starts with
"listing remote snapshots:", in that prefix a second time.
syncWithRemote now returns it unwrapped, as CleanupLocalSnapshots
does.

Judgement call: a credential pulled into the config through smartconfig
substitution counts as set by the file.

Model: opus-5-5

internal/config/config.go

@@ -304,7 +304,7 @@ func Load(path string) (*Config, error) {
 	if statErr == nil {
 		mode := info.Mode().Perm()
 		if mode&0044 != 0 { // group or world readable
-			log.Warn("Config file has insecure permissions (contains S3 credentials)",
+			log.Warn(cfg.readableByOthersWarning(),
 				"path", path,
 				"mode", fmt.Sprintf("%04o", mode),
 				"recommendation", "chmod 600 "+path)
@@ -411,6 +411,16 @@ func (c *Config) setAgeSecretKey() {
 	}
 }
 
+// readableByOthersWarning is the warning Load logs when others can read
+// the config file. It names the S3 credentials only when they are set.
+func (c *Config) readableByOthersWarning() string {
+	if c.S3.AccessKeyID != "" || c.S3.SecretAccessKey != "" {
+		return "Config file contains S3 credentials and is readable by others"
+	}
+
+	return "Config file is readable by others"
+}
+
 // validateStorage validates storage configuration.
 // If StorageURL is set, it takes precedence. S3 URLs require credentials.
 // File URLs don't require any S3 configuration.