Parse the age identity key once and accept every identity in it (closes #165)

Restore and verify --deep now parse the configured age secret key a single time through a new helper that uses age.ParseIdentities and hands every identity to age.Decrypt. A key file with several identities (a whole age-keygen file) is fully accepted, so a blob encrypted to any of its recipients decrypts, not just the first.

The helper is the first step of both commands, so a missing or unparseable key fails before anything is downloaded. Its error names the config source and never echoes the key value. config.extractAgeSecretKey and its silent fallback are removed; the key is stored raw and parsed only where decryption happens. README, the restore help, and the missing-key error now read the key from a file with \$(cat ...) rather than typed literally, keeping it out of shell history.

Model: opus-4-8

README.md

@@ -74,11 +74,16 @@ Requirements that no existing tool meets:
 # verify a snapshot (shallow: checks all blobs are present with the listed size)
 vaultik snapshot verify <snapshot-id>
 
+# put the private key file in the environment (reading it from the file
+# keeps the key out of your shell history); the whole age-keygen file,
+# with one or more identities, is accepted
+export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
+
 # deep verify (downloads and cryptographically verifies every blob)
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' vaultik snapshot verify --deep <snapshot-id>
+vaultik snapshot verify --deep <snapshot-id>
 
 # restore (requires the private key)
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' vaultik snapshot restore <snapshot-id> /tmp/restored
+vaultik snapshot restore <snapshot-id> /tmp/restored
 
 # daily cron job: back up, keep a 4-week rolling window of snapshots
 # 0 3 * * * vaultik snapshot create --cron --prune --keep-newer-than 4w
@@ -119,15 +124,17 @@ Use that remote key — the hex printed inside `<remote only:...>`, or the
 full `remote_key` from `snapshot list --json` — to restore and verify:
 
 ```sh
+# put the private key file in the environment (reading it from the file
+# keeps the key out of your shell history)
+export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"
+
 # restore everything to /tmp/restored, then check every restored file's
 # chunk hashes
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' \
-  vaultik snapshot restore --verify <remote-key> /tmp/restored
+vaultik snapshot restore --verify <remote-key> /tmp/restored
 
 # optionally, deep-verify the snapshot against the store (downloads and
 # cryptographically checks every blob)
-VAULTIK_AGE_SECRET_KEY='AGE-SECRET-KEY-...' \
-  vaultik snapshot verify --deep <remote-key>
+vaultik snapshot verify --deep <remote-key>
 ```
 
 `age_recipients` (the public key) is not needed to restore — only the
@@ -217,7 +224,7 @@ and `vaultik prune --json | jq .` both work as written.
 
 ### environment variables
 
-* `VAULTIK_AGE_SECRET_KEY`: Age private key for decryption (required for `snapshot restore` and `snapshot verify --deep`)
+* `VAULTIK_AGE_SECRET_KEY`: Age private key for decryption (required for `snapshot restore` and `snapshot verify --deep`). May hold the whole `age-keygen` file — comments and every identity in it are accepted. Set it from the file, e.g. `export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)"`, so the key is not typed into your shell history.
 * `VAULTIK_CONFIG`: Path to config file (overridden by `--config`)
 * `VAULTIK_INDEX_PATH`: Override local SQLite index path
 * `VAULTIK_CPUPROFILE`: Write a CPU profile to this path for the duration of the run (development/debugging)