feat: l for details; details for vaults, scopes and files; getting started; the age of cached lists (#17)

- `l` goes to the details of what is selected; `enter` still drills in
- vaults, scopes and files show their details (vault settings from the listing, no extra requests)
- with nothing to show, the right pane says how to get started
- a list from the cache says how old it is while it reloads
- what is expiring, in the status pane and `lazysecrets expiring`
- when access is refused, what to check, for Azure and Databricks
- no group list in an account's details, and no Microsoft Graph call for it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks.go

@@ -317,15 +317,52 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return v, nil
 }
 
+// deniedChecks are what to check when Databricks refuses: the network,
+// when the workspace's IP access list refused, else access, and for a
+// profile signed in through az, which account az is on.
+func deniedChecks(pr profile, msg string) []string {
+	if strings.Contains(msg, "IP ACL") || strings.Contains(msg, "IP access list") {
+		return []string{
+			"you're on a network the workspace lets in (VPN, office)",
+			"the workspace's admin has let your network in",
+		}
+	}
+	var checks []string
+	if pr.authType == "azure-cli" {
+		checks = append(checks, "az is signed in as the account with access: profile "+pr.name+" uses your az login (az account show)")
+	}
+	return append(checks,
+		"you have access to the workspace",
+		"the scope's manager has given you READ on it, or a group you're in",
+	)
+}
+
 var errNoFallback = errors.New("no Key Vault fallback")
 
-// combine reports both the Databricks and the Key Vault failure. An auth
-// error from either stays reachable with errors.As.
+// combine reports both the Databricks and the Key Vault failure, with
+// both their checks after. An auth error from either stays reachable
+// with errors.As.
 func combine(dbxErr, kvErr error) error {
 	if errors.Is(kvErr, errNoFallback) {
 		return dbxErr
 	}
-	return fmt.Errorf("%w; Key Vault fallback: %w", dbxErr, kvErr)
+	var checks []string
+	strip := func(err error) error {
+		if d, ok := err.(*provider.Denied); ok {
+			for _, c := range d.Checks {
+				if !slices.Contains(checks, c) {
+					checks = append(checks, c)
+				}
+			}
+			return d.Err
+		}
+		return err
+	}
+	err := fmt.Errorf("%w; Key Vault fallback: %w", strip(dbxErr), strip(kvErr))
+	if len(checks) > 0 {
+		return &provider.Denied{Err: err, Checks: checks}
+	}
+	return err
 }
 
 // classify turns authentication failures into *provider.AuthError: a 401
@@ -336,6 +373,9 @@ func classify(pr profile, err error) error {
 	}
 	var api *apierr.APIError
 	if errors.As(err, &api) {
+		if api.StatusCode == 403 {
+			return &provider.Denied{Err: err, Checks: deniedChecks(pr, api.Message)}
+		}
 		if api.StatusCode != 401 {
 			return err
 		}