feat: sensitivity levels and location-aware scoped entries

[moukrea]

Summary

• Sensitivity levels: entries classified as secret (🔒 masked/scrubbed) or plain (📋 readable via opaq reveal). --secret/--plain flags on add with interactive prompt fallback. Search shows emoji indicators. run only masks sensitive values.
• Location-aware scopes: same entry name holds different values per directory. --global/--user/--current flags on add. Nearest-ancestor-wins resolution. New shadows and cleanup commands for scope management.
• Store migration: versioned format (V0→V1) with transparent migration preserving backward compatibility.
• New commands: reveal (read plain values), shadows (visualize scope overlap, TTY-only), cleanup (detect stale scopes, TTY-only).
• Updated commands: search (emoji indicators, scope display, --all-scopes), edit (sensitivity/scope toggles), remove (scope disambiguation), export/import (scope-aware merge).
• 160 tests passing (113 unit + 47 integration).

Test plan

• cargo build --release succeeds
• cargo clippy -- -D warnings clean
• cargo test — 160 tests passing
• Manual test: add secret and plain entries, verify search output
• Manual test: add scoped entries, verify reveal resolves correctly
• Manual test: shadows and cleanup commands
• Manual test: export/import roundtrip with scoped entries