06594afc57
- Add cmd/keys.go with six subcommands backed by the Plan 04 query layer - keys list prints masked findings with id/provider/confidence/source columns and supports --provider/--verified/--limit/--unmask filters - keys show <id> renders a finding fully unmasked with verify metadata - keys export --format=json|csv reuses the formatter registry, atomic file writes when --output is set - keys copy <id> uses atotto/clipboard for clipboard handoff - keys delete <id> prompts via cmd.InOrStdin unless --yes is passed - keys verify <id> gates on verify.EnsureConsent, then updates the stored row inline via UPDATE findings SET verify_* using db.SQL() - Remove the keysCmd stub from cmd/stubs.go (single declaration) - All subcommands read config via openDBWithKey() mirroring scan.go