Fix missing-key errors for restore and deep verify to name both key sources (closes #401)

errSecretKeyRequired and errDecryptionKeyRequired now share one message that says the age secret key is missing and names both places it can be set, the VAULTIK_AGE_SECRET_KEY environment variable first since it is preferred, then the age_secret_key config file field.

Model: deepseek-v4-pro

internal/vaultik/restore.go

@@ -30,11 +30,7 @@ var (
 	errFilesFailedRestore    = errors.New("file(s) failed to restore")
 	errPathsNotInSnapshot    = errors.New("requested path(s) not in the snapshot")
 	errFilesFailedVerify     = errors.New("files failed verification")
-	errDecryptionKeyRequired = errors.New(
+	errDecryptionKeyRequired = errors.New(ageSecretKeyMissingMessage)
-		"decryption key required for restore\n\n" +
-			"Set the VAULTIK_AGE_SECRET_KEY environment variable to your " +
-			"age private key file:\n" +
-			"  export VAULTIK_AGE_SECRET_KEY=\"$(cat vaultik_backup_private_key.txt)\"")
 	// errInvalidAgeSecretKey is returned when the configured key does not
 	// parse as any age identity. It names the source but never the value,
 	// which is secret, so the message is safe to print and log.

internal/vaultik/restore_identity_test.go

@@ -106,3 +106,18 @@ func TestRestoreIdentitiesMissingKey(t *testing.T) {
 	_, err := v.restoreIdentities()
 	require.ErrorIs(t, err, errDecryptionKeyRequired)
 }
+
+// TestMissingKeyErrorsNameBothSources asserts the missing-key errors for
+// restore and deep verify say the key is missing and name both places it
+// can be set, the environment variable first since it is preferred, with
+// the same wording in both.
+func TestMissingKeyErrorsNameBothSources(t *testing.T) {
+	t.Parallel()
+
+	const want = "age secret key is missing; set it in " +
+		"the VAULTIK_AGE_SECRET_KEY environment variable or the " +
+		"age_secret_key config file field"
+
+	require.Equal(t, want, errSecretKeyRequired.Error())
+	require.Equal(t, want, errDecryptionKeyRequired.Error())
+}

internal/vaultik/verify.go

@@ -20,11 +20,18 @@ import (
 	"sneak.berlin/go/vaultik/internal/storage"
 )
 
+// ageSecretKeyMissingMessage is the shared text of the missing-key errors
+// for restore and deep verify. It says the key is missing and names both
+// places it can come from, the environment variable first since it is
+// preferred.
+const ageSecretKeyMissingMessage = "age secret key is missing; set it in " +
+	"the VAULTIK_AGE_SECRET_KEY environment variable or the " +
+	"age_secret_key config file field"
+
 // Sentinel errors for snapshot verification failures.
 var (
-	errVerificationFailed = errors.New("verification failed")
+	errVerificationFailed  = errors.New("verification failed")
-	errSecretKeyRequired  = errors.New(
+	errSecretKeyRequired   = errors.New(ageSecretKeyMissingMessage)
-		"VAULTIK_AGE_SECRET_KEY not set; required for deep verification")
 	errChunksOutOfOrder    = errors.New("chunks out of order")
 	errChunkHashMismatch   = errors.New("chunk hash mismatch")
 	errNegativeChunkLength = errors.New("chunk length is negative")