feat: lazysecrets list prints every source, vault and secret, for fzf and editor pickers

docs/links.md

@@ -136,6 +136,35 @@ it first), the Databricks profile for the workspace, or sops in your clone
 of the repo; a version in the link reads that version. The value ends with
 a newline only on a terminal.
 
+### Listing, for fzf and pickers
+
+`lazysecrets list` prints every source, vault and secret, one per line:
+its link, its kind (`source`, `vault`, `secret`, `key`, `certificate`)
+and its name, tab-separated. It's what Go to searches, so fzf, or an
+editor's picker, can search it instead:
+
+```sh
+lazysecrets list | fzf --delimiter='\t' --with-nth=3 \
+  --bind 'enter:become(lazysecrets open {1})' \
+  --bind 'ctrl-y:execute-silent(lazysecrets get {1} | pbcopy)'
+```
+
+What's [cached](config.md#cache) prints at once. Then, like Go to, it loads
+what's missing or older than `--max-age` (2m), and what's new in it follows
+as it arrives: fzf shows it while you type. `--cached` loads nothing from
+Azure or Databricks, for an answer at once. Repos are always read, from
+disk. What it loads is cached for the TUI too. Lists it can't read are
+reported on stderr; it stops when the reader goes, after a pick in fzf.
+
+`--format json` prints an object per line instead, for editor plugins:
+
+```json
+{"link":"lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/db-password","kind":"secret","provider":"azure","path":["platform-prod","kv-app-prod","db-password"],"account":"alice"}
+```
+
+`account` is there when several az accounts are signed in. Values are never
+listed.
+
 ## From the browser and chat
 
 ```sh