feat: share env files as encrypted links

S → f on a repo, an env file or a key in one copies a
lazysecrets://share link holding the env files, encrypted (age) with
a secret's value: whoever can read that secret can open it. The key is
share.key in the repo's .lazysecrets.yaml, else in the config, else
picked when sharing; on Azure the link pins its version. Opening one
says what it holds, decrypts when asked, and saves the files in the
clone of the repo (or a folder chosen), replacing existing ones only
when asked. lazysecrets share prints a link from the command line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/links.md

@@ -20,10 +20,66 @@ lazysecrets://repo/git.example.com%2Fteam%2Finfra/secrets%2Fapp.yaml/db.password
 that version). `S` opens the share menu:
 
 - secrets: the link (`o`), the plain Key Vault URL (`u`), the config
-  reference (`y`) or the web page (`b`)
+  reference (`y`) or the web page (`b`); in an env file, also the file as
+  an [encrypted link](#sharing-env-files) (`f`)
 - vaults and scopes: a link (`o`), a link that opens on the current tab
   (`t`), the plain vault URL (`u`) or the web page (`b`)
 - subscriptions and workspaces: a link (`o`) or the web page (`b`)
+- repos and env files: also their env files as an
+  [encrypted link](#sharing-env-files) (`f`)
+
+## Sharing env files
+
+`.env` files usually live only on your machine. `S` → `f` shares them as
+an encrypted link, on a repo (all its plain env files), an env file, or a
+key in one (its file):
+
+```
+lazysecrets://share/AQ…
+```
+
+The files are encrypted with a secret's value, so whoever can read that
+secret (in Key Vault, Databricks or a repo's SOPS file) can open the link,
+and nobody else: who may open it is up to the vault's access, as for
+everything else. Make a secret for it once, random and at least 16
+characters:
+
+```sh
+az keyvault secret set --vault-name kv-team --name env-share --value "$(openssl rand -base64 32)"
+```
+
+and name it in the repo's `.lazysecrets.yaml` (committed: the whole team
+uses it) or your config (for repos that don't name one), or pick one when
+sharing:
+
+```yaml
+share:
+  key: lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share
+```
+
+On the command line, `lazysecrets share [--key <link>] <env file>...`
+prints the link.
+
+Opening a share link says which repo it's from, how many files and which
+secret it's encrypted with, and decrypts only when asked: lazysecrets
+reads the secret with your access, then shows where each file goes in
+your clone of the repo (or asks for a folder, if it isn't here), which
+ones would replace a file there and which ones git doesn't ignore. It
+saves them all, only the new ones, or none. New files are readable by you
+only.
+
+A link holds the files' paths and contents encrypted ([age](https://age-encryption.org),
+the secret's value as passphrase); the repo, the secret and the number of
+files are in the clear. Links stay under 16 KB, which fits chat and
+tickets.
+
+A link stays readable as long as its secret is. On Azure it's pinned to
+the secret's version, so adding a new version (rotating) doesn't break
+old links, and disabling the old version, or taking away someone's
+access, shuts them out; Databricks secrets have no versions, so changing
+the value breaks every old link. Whoever has read the secret's value
+before can decrypt links made with it without asking the vault, so rotate
+it now and then: new links use the newest version.
 
 ## Opening