feat: e opens a repo's SOPS or .env file, in nvim, sops edit or your editor (#1)

`e` on a file in a repo opens it; on a secret, it opens the file at that key's line.

- **SOPS files**: `sops edit` in the terminal, then back to lazysecrets with the keys reloaded. Exit 200 (nothing changed) shows "unchanged".
- **Other files inside nvim** (`$NVIM` set): lazysecrets asks that nvim, over `--remote-expr`, to open the file once lazysecrets' terminal closes, then quits. The file lands in the window you came from, not the closing float. Started from a shell in a terminal, it opens in the previous window straight away. No change to the nvim plugin is needed.
- **Otherwise**: `$VISUAL`/`$EDITOR` in the terminal (with `+N`, `file:N` or `-g file:N` for editors that take a line), else the system default app.

The repo provider now records each key's line (YAML node lines, env/ini line numbers) behind a new optional `provider.Files` interface. Other providers show "only SOPS and .env files in repos can be opened".

The nvim handoff was tested against a headless nvim 0.12: a floating terminal closed on exit the way snacks does, and a shell in a split. A file name with a space and a quote opened at the right line in both. Unit tests cover lines per format, the nvim, sops and default-app paths, and the editor line arguments.

Note: `e` is a new default key, so a config that already binds `e` to something else now gets the "bound to both" error, until one of them is rebound.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #1

docs/keys.md

@@ -52,6 +52,7 @@ match case exactly.
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
+| `e` | open the selected SOPS or `.env` file, or a secret's file at its line ([how](repos.md#opening-files)) |
 | `s` / `S` | copy a [link](links.md) to the selected item / share menu |
 | `ctrl+o` | open a link or reference (or just paste one) |
 | `x` | [custom commands](custom-commands.md) |

docs/repos.md

@@ -63,6 +63,24 @@ copying or `lazysecrets get` decrypts one value with your `sops` binary, so
 whatever sops uses works (age keys, Azure Key Vault through az, AWS/GCP
 KMS, PGP). When sops can't decrypt, its whole error message is shown.
 
+## Opening files
+
+`e` opens the selected file, or on a secret, its file at that key's line:
+
+- **SOPS files** open with `sops edit`, which decrypts them into your
+  editor (`$SOPS_EDITOR` or `$EDITOR`) and encrypts them again when you
+  save. lazysecrets comes back after, with the file's keys reloaded.
+- **Other files**, when lazysecrets runs inside nvim (its plugin, or
+  `:terminal`): lazysecrets quits and the file opens in that nvim, in the
+  window you came from.
+- Otherwise in `$VISUAL` or `$EDITOR` in the terminal, coming back after;
+  without either, in the system's default app for the file.
+
+Editors that take a line (vim, nvim, nano, emacs, micro, helix, VS Code,
+Zed, Sublime and others) start on the key. With `sops edit` that works for
+editors taking `+N` (vim, nvim, nano, emacs, micro and others), and needs
+sops 3.8 or later.
+
 ## Links
 
 Links name the repo by its git remote, so they open in a colleague's clone