feat(06-05): implement keys command tree (list/show/export/copy/delete/verify)

- Add cmd/keys.go with six subcommands backed by the Plan 04 query layer
- keys list prints masked findings with id/provider/confidence/source columns
  and supports --provider/--verified/--limit/--unmask filters
- keys show <id> renders a finding fully unmasked with verify metadata
- keys export --format=json|csv reuses the formatter registry, atomic
  file writes when --output is set
- keys copy <id> uses atotto/clipboard for clipboard handoff
- keys delete <id> prompts via cmd.InOrStdin unless --yes is passed
- keys verify <id> gates on verify.EnsureConsent, then updates the stored
  row inline via UPDATE findings SET verify_* using db.SQL()
- Remove the keysCmd stub from cmd/stubs.go (single declaration)
- All subcommands read config via openDBWithKey() mirroring scan.go

cmd/stubs.go

@@ -33,11 +33,7 @@ var reconCmd = &cobra.Command{
 	RunE:  notImplemented("recon", "Phase 9"),
 }
 
-var keysCmd = &cobra.Command{
-	Use:   "keys",
-	Short: "Manage stored keys (list, export, delete) (Phase 6)",
-	RunE:  notImplemented("keys", "Phase 6"),
-}
+// keysCmd is implemented in cmd/keys.go (Phase 6).
 
 var serveCmd = &cobra.Command{
 	Use:   "serve",