Refactor: Move Vaultik struct and methods to internal/vaultik package

- Created new internal/vaultik package with unified Vaultik struct
- Moved all command methods (snapshot, info, prune, verify) from CLI to vaultik package
- Implemented single constructor that handles crypto capabilities automatically
- Added CanDecrypt() method to check if decryption is available
- Updated all CLI commands to use the new vaultik.Vaultik struct
- Removed old fragmented App structs and WithCrypto wrapper
- Fixed context management - Vaultik now owns its context lifecycle
- Cleaned up package imports and dependencies

This creates a cleaner separation between CLI/Cobra code and business logic,
with all vaultik operations now centralized in the internal/vaultik package.

internal/database/chunks.go

@@ -139,7 +139,7 @@ func (r *ChunkRepository) ListUnpacked(ctx context.Context, limit int) ([]*Chunk
 	return chunks, rows.Err()
 }
 
-// DeleteOrphaned deletes chunks that are not referenced by any file
+// DeleteOrphaned deletes chunks that are not referenced by any file or blob
 func (r *ChunkRepository) DeleteOrphaned(ctx context.Context) error {
 	query := `
 		DELETE FROM chunks 
@@ -147,6 +147,10 @@ func (r *ChunkRepository) DeleteOrphaned(ctx context.Context) error {
 			SELECT 1 FROM file_chunks 
 			WHERE file_chunks.chunk_hash = chunks.chunk_hash
 		)
+		AND NOT EXISTS (
+			SELECT 1 FROM blob_chunks 
+			WHERE blob_chunks.chunk_hash = chunks.chunk_hash
+		)
 	`
 
 	result, err := r.db.ExecWithLog(ctx, query)