feat: share env files as encrypted links

S → f on a repo, an env file or a key in one copies a
lazysecrets://share link holding the env files, encrypted (age) with
a secret's value: whoever can read that secret can open it. The key is
share.key in the repo's .lazysecrets.yaml, else in the config, else
picked when sharing; on Azure the link pins its version. Opening one
says what it holds, decrypts when asked, and saves the files in the
clone of the repo (or a folder chosen), replacing existing ones only
when asked. lazysecrets share prints a link from the command line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/app.go

@@ -81,6 +81,9 @@ type Options struct {
 	// CacheFile keeps what was loaded between runs; "" keeps it for this
 	// run only.
 	CacheFile string
+	// ShareKey is the config's share.key: the secret that encrypts shared
+	// env files, for repos whose .lazysecrets.yaml names none.
+	ShareKey string
 	// Dir is the folder lazysecrets runs in: it goes back to where it was
 	// left there, unless it was started on a link. "" doesn't.
 	Dir string
@@ -270,6 +273,10 @@ type Model struct {
 	linked     []provider.Container // vaults opened from links, this session
 	open       *ref.Ref             // reference to open at startup
 
+	// shareKey is the config's share.key; lastShareKey the key last
+	// typed when sharing, offered next time.
+	shareKey, lastShareKey string
+
 	// A lazysecrets:// link found on the clipboard, offered in the footer.
 	dismissedLink string // the last link offered: not offered again
 	clipChecked   time.Time
@@ -455,6 +462,7 @@ func New(providers []provider.Provider, opts Options) Model {
 	m.spinning = true
 
 	m.cachePath, m.placeDir, m.sourcesAt = opts.CacheFile, opts.Dir, map[string]time.Time{}
+	m.shareKey = opts.ShareKey
 	m.configFiles, m.statePath, m.changelog = opts.ConfigFiles, opts.StatePath, changelogFields(opts.Changelog)
 	if m.cachePath != "" {
 		m.loadCacheFile()
@@ -570,6 +578,15 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 	case resolvedMsg:
 		m.handleResolved(msg)
 
+	case shareFilesMsg:
+		cmds = append(cmds, m.handleShareFiles(msg))
+
+	case sealedMsg:
+		cmds = append(cmds, m.handleSealed(msg))
+
+	case shareOpenedMsg:
+		cmds = append(cmds, m.handleShareOpened(msg))
+
 	case tea.PasteMsg:
 		cmds = append(cmds, m.handlePaste(msg))