feat: a key that no longer decrypts a share link says why

By where it lives: a Databricks secret or SOPS value has changed
since the link was made, an Azure secret's current version isn't the
link's (unpinned), and a pinned version can't have changed, so the
link may be damaged. The popup wraps the reason instead of cutting
it; r is for what Key Vault adds to check.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/sharefiles.go

@@ -304,16 +304,16 @@ func (m *Model) handleShareOpened(msg shareOpenedMsg) tea.Cmd {
 }
 
 // openFailed says why a share link couldn't be decrypted, in a popup
-// where its offer was: its first line, or with whole all of it
+// where its offer was: its first line (wrapped), or with whole all of it
 // (Key Vault's refusals say what to check on later lines). From there,
 // the key's secret can be gone to: its version, which may be disabled.
 func (m *Model) openFailed(s share.Sealed, err error, whole bool) {
 	width := max(30, min(m.w-12, 76))
 	text := capitalize(err.Error())
 	first, rest, _ := strings.Cut(text, "\n")
-	cut := !whole && (rest != "" || ansi.StringWidth(first) > width-2)
+	cut := !whole && rest != "" // more than the reason: what to check
 	if !whole {
-		text = ansi.Truncate(first, width-2, "…")
+		text = first
 	}
 	var lines []string
 	for i, l := range strings.Split(ansi.Wordwrap(text, width-2, " "), "\n") {