feat: l for details; details for vaults, scopes and files; getting started; the age of cached lists (#17)

- `l` goes to the details of what is selected; `enter` still drills in
- vaults, scopes and files show their details (vault settings from the listing, no extra requests)
- with nothing to show, the right pane says how to get started
- a list from the cache says how old it is while it reloads
- what is expiring, in the status pane and `lazysecrets expiring`
- when access is refused, what to check, for Azure and Databricks
- no group list in an account's details, and no Microsoft Graph call for it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/databricks/databricks_test.go

@@ -140,6 +140,15 @@ func workspaceAPI(t *testing.T, status int) *httptest.Server {
 				map[string]any{"key": "storage-key", "last_updated_timestamp": 1767225600000},
 				map[string]any{"key": "client-secret"},
 			}})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "app":
+			write(w, 200, map[string]any{"items": []any{
+				map[string]any{"principal": "users", "permission": "READ"},
+				map[string]any{"principal": "admins", "permission": "MANAGE"},
+			}})
+		case r.URL.Path == "/api/2.0/secrets/list" && q.Get("scope") == "locked":
+			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have READ permission on scope locked"})
+		case r.URL.Path == "/api/2.0/secrets/acls/list" && q.Get("scope") == "locked":
+			write(w, 403, map[string]any{"error_code": "PERMISSION_DENIED", "message": "User does not have MANAGE permission"})
 		case r.URL.Path == "/api/2.0/secrets/get" && q.Get("scope") == "app":
 			write(w, 200, map[string]any{"key": q.Get("key"),
 				"value": base64.StdEncoding.EncodeToString([]byte("value-of-" + q.Get("key")))})
@@ -291,3 +300,44 @@ func TestClassify(t *testing.T) {
 		t.Error("cancellation classified as auth")
 	}
 }
+
+func TestScopeDetails(t *testing.T) {
+	p := newTestProvider(t, workspaceAPI(t, 0), nil)
+	src := provider.Source{ID: "prod"}
+	attrs, err := p.Details(context.Background(), provider.Container{Source: src, Name: "app"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []provider.Attr{{Label: "access", Value: "admins · manage"}, {Value: "users · read"}}
+	if !reflect.DeepEqual(attrs, want) {
+		t.Errorf("app: %+v", attrs)
+	}
+	attrs, err = p.Details(context.Background(), provider.Container{Source: src, Name: "locked"})
+	if err != nil || len(attrs) != 1 || !strings.Contains(attrs[0].Value, "managers") {
+		t.Errorf("locked: %+v, %v", attrs, err)
+	}
+}
+
+func TestDeniedSaysWhatToCheck(t *testing.T) {
+	p := newTestProvider(t, workspaceAPI(t, 0), nil)
+	_, err := p.Objects(context.Background(), provider.Container{Source: provider.Source{ID: "prod"}, Name: "locked"}, provider.TypeSecret)
+	var d *provider.Denied
+	// The test profile signs in through az: that's the first check.
+	if !errors.As(err, &d) || !strings.Contains(err.Error(), "READ permission on scope locked\n\nCheck:\n• az is signed in as the account with access: profile prod uses your az login") ||
+		!strings.Contains(err.Error(), "\n• you have access to the workspace") {
+		t.Errorf("err %q", err)
+	}
+	if got := deniedChecks(profile{authType: "pat"}, "denied"); strings.Contains(got[0], "az") {
+		t.Errorf("a token profile's checks %q", got)
+	}
+	if got := deniedChecks(profile{}, "Source IP address: 1.2.3.4 is blocked by Databricks IP ACL for workspace: 1"); !strings.Contains(got[0], "network") {
+		t.Errorf("IP ACL checks %q", got)
+	}
+
+	// Both refused: one message, then both lists of checks.
+	err = combine(&provider.Denied{Err: errors.New("dbx"), Checks: []string{"a", "b"}},
+		&provider.Denied{Err: errors.New("kv"), Checks: []string{"b", "c"}})
+	if got := err.Error(); got != "dbx; Key Vault fallback: kv\n\nCheck:\n• a\n• b\n• c" {
+		t.Errorf("combined %q", got)
+	}
+}