Parse the age identity key once and accept every identity in it (closes #165)

Restore and verify --deep now parse the configured age secret key a single time through a new helper that uses age.ParseIdentities and hands every identity to age.Decrypt. A key file with several identities (a whole age-keygen file) is fully accepted, so a blob encrypted to any of its recipients decrypts, not just the first.

The helper is the first step of both commands, so a missing or unparseable key fails before anything is downloaded. Its error names the config source and never echoes the key value. config.extractAgeSecretKey and its silent fallback are removed; the key is stored raw and parsed only where decryption happens. README, the restore help, and the missing-key error now read the key from a file with \$(cat ...) rather than typed literally, keeping it out of shell history.

Model: opus-4-8

internal/vaultik/blob_fetch.go

@@ -74,14 +74,15 @@ func (h *hashVerifyReader) Close() error {
 // The hash is verified when the returned reader is closed (after fully reading).
 // This avoids buffering the entire blob in memory.
 func (v *Vaultik) FetchAndDecryptBlob(
-	ctx context.Context, blobHash string, expectedSize int64, identity age.Identity,
+	ctx context.Context, blobHash string, expectedSize int64,
+	identities ...age.Identity,
 ) (io.ReadCloser, error) {
 	rc, _, err := v.FetchBlob(ctx, blobHash, expectedSize)
 	if err != nil {
 		return nil, err
 	}
 
-	reader, err := blobgen.NewReader(rc, identity)
+	reader, err := blobgen.NewReader(rc, identities...)
 	if err != nil {
 		_ = rc.Close()