Refuse a relative file:// storage_url and decode its escapes (closes #299)

The path after file:// was used as written. file://dest resolved
against the working directory, so a backup run from another directory
wrote elsewhere, exited 0 and left a snapshot that could not be
restored; my%20stick created a directory with that literal name.

Config load now refuses a file:// storage_url whose path is not
absolute. ParseStorageURL refuses it too and decodes percent-escapes;
a literal space still works. The rule is written in both packages
because config cannot import storage, which imports config.

A % not followed by two hex digits now fails when the storage is
opened, not at config load.

Model: opus-5-5

TODO.md

@@ -22,6 +22,17 @@ the tag exists and is exercised; what is left is merging `next` to
 
 # Completed Steps
 
+- 2026-10-13: Refused a `file://` `storage_url` whose path is relative
+  ([issue #299](https://git.eeqj.de/sneak/vaultik/issues/299)). The text
+  after `file://` was used as written, so `file://dest` resolved against
+  the working directory: a backup run from another directory wrote to a
+  different destination, still exited 0, and left a snapshot that could
+  not be restored. Such a URL now fails when the config loads, with an
+  error asking for an absolute path. Percent-escapes in the path are now
+  decoded, so `my%20stick` names the directory `my stick` instead of
+  creating one named `my%20stick`; a path written with a literal space
+  works as before.
+
 - 2026-10-12: Bound the local index to the destination an `s3.*` config
   names ([issue #298](https://git.eeqj.de/sneak/vaultik/issues/298)).
   Only `storage_url` was checked, so after `s3.bucket` or `s3.prefix`