feat: lazysecrets list shows unreadable lists as red ✗ lines, and filters by kind

docs/links.md

@@ -154,9 +154,18 @@ what's missing or older than `--max-age` (2m), and what's new in it follows
 as it arrives: fzf shows it while you type. `--cached` loads nothing from
 Azure or Databricks, for an answer at once. Repos are always read, from
 disk. What it loads is cached for the TUI too. It stops when the reader
-goes, after a pick in fzf. Lists it can't read are reported on stderr when
-it prints to the terminal; into a pipe they'd draw over fzf, so only with
-`--errors`.
+goes, after a pick in fzf.
+
+`--kind` lists only some kinds, comma-separated: `source`, `vault` (also
+Databricks scopes and repo files), `secret`, `key`, `certificate`. Lists
+only other kinds need aren't loaded: `--kind source,vault` asks for no
+secrets. Keys and certificates load only when asked for this way; else,
+like Go to, they're listed as far as you opened them in lazysecrets.
+
+A vault or source it can't read is a line too, as it fails: `✗`, its
+name and why, in red (`errorColor`), with its link, so opening it shows
+more. They're in the list, not on stderr, which would draw over fzf.
+`--errors=false` leaves them out.
 
 The name is coloured from your [theme](config.md#theme), with the
 provider's icon when [icons](config.md#theme) are on (`ui.icons`); fzf
@@ -164,8 +173,8 @@ shows the colours with `--ansi`. `--color never` leaves them out, for
 scripts, and `--icons=false` the icons. The link is never coloured.
 
 `--format json` prints an object per line instead, for editor plugins,
-without colours or icons, with each entry's kind (`source`, `vault`,
-`secret`, `key` or `certificate`):
+without colours or icons, with each entry's kind, and `error` on a list
+it couldn't read:
 
 ```json
 {"link":"lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password","kind":"secret","provider":"azure","path":["platform-prod","kv-app-prod","db-password"],"account":"alice"}