Restore and deep verify now report "cannot decrypt this snapshot: the
private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the backup
was encrypted to", naming the key source like the invalid-key error.
The doubled "creating decryption reader" prefix and the outer
"downloading snapshot database" / "failed to decrypt database" prefixes
are gone for this case.
A blob the key cannot decrypt, such as one stored before the key was
added as a recipient, now reports "cannot decrypt this blob: the
private key in VAULTIK_AGE_SECRET_KEY is not one of the keys the blob
was encrypted to" after the file and blob it belongs to.
Model: opus-5-5
sneak