feat(01-05): add CLI root command, config package, output table, and settings helpers

- cmd/root.go: Cobra root with all 11 subcommands, viper config loading
- cmd/stubs.go: 8 stub commands for future phases (verify, import, recon, keys, serve, dorks, hook, schedule)
- cmd/scan.go: scan command wiring engine + storage + output with per-installation salt
- cmd/providers.go: providers list/info/stats subcommands
- cmd/config.go: config init/set/get subcommands
- pkg/config/config.go: Config struct with Load() and defaults
- pkg/output/table.go: lipgloss terminal table for PrintFindings
- pkg/storage/settings.go: GetSetting/SetSetting for settings table CRUD

pkg/config/config.go

@@ -0,0 +1,28 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// Config holds all KeyHunter runtime configuration.
+// Values are populated from ~/.keyhunter.yaml, environment variables, and CLI flags (in that precedence order).
+type Config struct {
+	DBPath     string // path to SQLite database file
+	ConfigPath string // path to config YAML file
+	Workers    int    // number of scanner worker goroutines
+	Passphrase string // encryption passphrase (sensitive)
+}
+
+// Load returns a Config with defaults applied.
+// Callers should override individual fields after Load() using viper-bound values.
+func Load() Config {
+	home, _ := os.UserHomeDir()
+	return Config{
+		DBPath:     filepath.Join(home, ".keyhunter", "keyhunter.db"),
+		ConfigPath: filepath.Join(home, ".keyhunter.yaml"),
+		Workers:    runtime.NumCPU() * 8,
+		Passphrase: "", // Phase 1: empty passphrase; Phase 6+ will prompt
+	}
+}