Parse age_recipients at config load and never echo the entry (closes #153)

Config.Validate now parses every age_recipients entry with
age.ParseX25519Recipient, so a bad recipient fails at config load instead
of deep in a backup after the snapshot row and tree walk. On failure the
error names the position (age_recipients[N]) and never the value: a
recipient string can itself be a secret key an operator pasted by mistake,
and age's own error quotes its input. An entry starting with
AGE-SECRET-KEY- (compared case-insensitively) gets a specific message.

The remaining parse sites (blobgen.NewWriter, crypto NewEncryptor and
UpdateRecipients), reachable by callers that skip config.Load, likewise
drop the value and age's wrapped error, naming only the position.

test/config.yaml's placeholder second recipient is replaced with a valid
X25519 key so it still loads.

Model: opus-4-8

internal/crypto/encryption_test.go

@@ -2,6 +2,7 @@ package crypto_test
 
 import (
 	"bytes"
+	"strings"
 	"testing"
 
 	"filippo.io/age"
@@ -176,3 +177,22 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 		t.Error("should not decrypt with identity1")
 	}
 }
+
+// TestNewEncryptorSecretKeyNotEchoed verifies that a secret key mistakenly
+// passed as a recipient does not appear in the returned error. A recipient
+// string can be sensitive, so the error must name only the position.
+func TestNewEncryptorSecretKeyNotEchoed(t *testing.T) {
+	t.Parallel()
+
+	secretKey := "AGE-SECRET-KEY-19CR5YSFW59HM4TLD6GX" +
+		"VEDMZFTVVF7PPHKUT68TXSFPK7APHXA2QS2NJA5"
+
+	_, err := crypto.NewEncryptor([]string{secretKey})
+	if err == nil {
+		t.Fatal("NewEncryptor returned nil, want error")
+	}
+
+	if strings.Contains(err.Error(), secretKey) {
+		t.Fatalf("error echoed the recipient value: %v", err)
+	}
+}