feat: a key that can't be used is explained in the picker

The key picker stays open until the link is made, saying "encrypting
with …" meanwhile. A key that can't be read, or doesn't keep to
share.keyRules, is shown in it in red with which rule it misses
("its value has 28 characters; share.keyRules needs 32
(minLength)"), to pick another.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/sharefiles_test.go

@@ -200,8 +200,16 @@ func TestShareInDemo(t *testing.T) {
 	if d.m.search == nil || d.m.search.pick == nil {
 		t.Fatalf("no picker: %s", d.m.flash.text)
 	}
+	// Too short a key: the picker stays, saying why.
+	d.send(tea.PasteMsg{Content: "https://kv-app-prod.vault.azure.net/secrets/db-password"})
+	if d.m.search == nil || !strings.Contains(d.m.search.pickErr, "Can't use db-password: its value has 28 characters; share.keyRules needs 32 (minLength)") {
+		t.Fatalf("not said in the picker: %v\n%s", d.m.search != nil, d.screen())
+	}
+	if !strings.Contains(d.screen(), "28 characters") {
+		t.Errorf("not shown:\n%s", d.screen())
+	}
 	d.send(tea.PasteMsg{Content: "https://kv-shared-prod.vault.azure.net/secrets/env-share"})
-	if !strings.HasPrefix(clip.content, "lazysecrets://share/") {
+	if !strings.HasPrefix(clip.content, "lazysecrets://share/") || d.m.search != nil {
 		t.Fatalf("copied %q (%s)", clip.content, d.m.flash.text)
 	}
 	link := clip.content