Refactor: Move Vaultik struct and methods to internal/vaultik package

- Created new internal/vaultik package with unified Vaultik struct
- Moved all command methods (snapshot, info, prune, verify) from CLI to vaultik package
- Implemented single constructor that handles crypto capabilities automatically
- Added CanDecrypt() method to check if decryption is available
- Updated all CLI commands to use the new vaultik.Vaultik struct
- Removed old fragmented App structs and WithCrypto wrapper
- Fixed context management - Vaultik now owns its context lifecycle
- Cleaned up package imports and dependencies

This creates a cleaner separation between CLI/Cobra code and business logic,
with all vaultik operations now centralized in the internal/vaultik package.

internal/crypto/encryption.go

@@ -7,6 +7,7 @@ import (
 	"sync"
 
 	"filippo.io/age"
+	"go.uber.org/fx"
 )
 
 // Encryptor provides thread-safe encryption using the age encryption library.
@@ -143,3 +144,66 @@ func (e *Encryptor) UpdateRecipients(publicKeys []string) error {
 
 	return nil
 }
+
+// Decryptor provides thread-safe decryption using the age encryption library.
+// It uses a private key to decrypt data that was encrypted for the corresponding
+// public key.
+type Decryptor struct {
+	identity age.Identity
+	mu       sync.RWMutex
+}
+
+// NewDecryptor creates a new decryptor with the given age private key.
+// The private key should be a valid age X25519 identity string.
+// Returns an error if the private key is invalid.
+func NewDecryptor(privateKey string) (*Decryptor, error) {
+	identity, err := age.ParseX25519Identity(privateKey)
+	if err != nil {
+		return nil, fmt.Errorf("parsing age identity: %w", err)
+	}
+
+	return &Decryptor{
+		identity: identity,
+	}, nil
+}
+
+// Decrypt decrypts data using age decryption.
+// This method is suitable for small to medium amounts of data that fit in memory.
+// For large data streams, use DecryptStream instead.
+func (d *Decryptor) Decrypt(data []byte) ([]byte, error) {
+	d.mu.RLock()
+	identity := d.identity
+	d.mu.RUnlock()
+
+	r, err := age.Decrypt(bytes.NewReader(data), identity)
+	if err != nil {
+		return nil, fmt.Errorf("creating decrypted reader: %w", err)
+	}
+
+	decrypted, err := io.ReadAll(r)
+	if err != nil {
+		return nil, fmt.Errorf("reading decrypted data: %w", err)
+	}
+
+	return decrypted, nil
+}
+
+// DecryptStream returns a reader that decrypts data from the provided reader.
+// This method is suitable for decrypting large files or streams as it processes
+// data in a streaming fashion without loading everything into memory.
+// The caller should close the input reader when done.
+func (d *Decryptor) DecryptStream(src io.Reader) (io.Reader, error) {
+	d.mu.RLock()
+	identity := d.identity
+	d.mu.RUnlock()
+
+	r, err := age.Decrypt(src, identity)
+	if err != nil {
+		return nil, fmt.Errorf("creating decrypted reader: %w", err)
+	}
+
+	return r, nil
+}
+
+// Module exports the crypto module for fx dependency injection.
+var Module = fx.Module("crypto")