secrets identity rotate: per-vault scoping with --user / --project

[xaaha]

Part of #171. Identity rotation is per-vault, there is no global registry of vaults.

Command name

hulak secrets identity rotate in pkg/userFlags/secrets/rotate.go.

Goal

Make rotation explicit about which vault it is rotating, and document the multi-project reality honestly instead of implying a global rotate.

Changes

pkg/userFlags/secrets/rotate.go

• Default rotates the in-scope vault: project when one is found, otherwise user
• --user and --project override, via cliflags.RegisterScope from secrets list / secrets keys list: merged view with --user / --project filters #191
• Refuses cleanly when there is no in-scope vault and no flag
• The command prints which vault it is about to rotate before doing any work

The identity at <UserConfigDir()>/identity.txt is global. There is one per OS user. Rotation swaps the old identity for the new one in the recipient list of one specific vault and re-encrypts that vault.

Help text and docs need a note: a user with N project vaults runs rotate N times, once per cd. There is deliberately no --all flag, because discovery has no registry of every vault the user owns. Walking the filesystem to find them would be worse than making the user be explicit.

Tests

• Rotating a project vault leaves user-vault recipients untouched
• --user rotates the user vault from inside a project
• Rotation succeeds while other vaults exist and are not touched
• Rotation refuses with a clear error when no vault is in scope and no flag is given
• The target vault path is printed before rotation begins

Depends on

#190, #195