feat: a key that can't be used is explained in the picker

The key picker stays open until the link is made, saying "encrypting
with …" meanwhile. A key that can't be read, or doesn't keep to
share.keyRules, is shown in it in red with which rule it misses
("its value has 28 characters; share.keyRules needs 32
(minLength)"), to pick another.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share_test.go

@@ -62,7 +62,7 @@ func TestSealRefuses(t *testing.T) {
 		files []File
 		want  string
 	}{
-		"short key":    {Header{Key: key}, []byte("short"), ok, "keyRules wants"},
+		"short key":    {Header{Key: key}, []byte("short"), ok, "needs 32 (minLength)"},
 		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "isn't a secret"},
 		"no files":     {Header{Key: key}, pass, nil, "no files"},
 		"not env":      {Header{Key: key}, pass, []File{{Path: "main.go", Data: []byte("x")}}, "isn't an env file"},