feat: formatted JSON and certificates, errors in the status pane, no scope access list (#19)

**Formatted values.** A revealed value is shown as it reads best: JSON indented, and PEM certificates as subject, issuer, valid dates, names and SHA-1 thumbprint instead of base64. Any other PEM block (a private key in a bundle) is named, `EC PRIVATE KEY (not shown)`, never shown. Anything else shows as before. `y` copies the value exactly as stored, and the hints line says so (`JSON, formatted: y copies it as stored`).

**Errors in the status pane.** This session's errors, newest first, up to 20, with the time and what they were about (`12:32 kv-restricted: 403 Forbidden: …`): lists that couldn't load, values and details that couldn't be read, sources, saving the cache, and whatever the footer flashed (a failed copy) before you moved on. A repeat moves to the top. Sign-ins aren't listed (the footer and the account say those). Only the first line of each, and not kept after quitting. `y` copies one.

**No access list for Databricks scopes.** It was the one request of its own left (one call per scope). Removed with its tests and docs; refusals still say what to check.

**Copying over SSH: checked, nothing to change.** Over SSH (`SSH_TTY`/`SSH_CONNECTION`), `y` copies with OSC 52, and the 30-second clear works the same way. Your tmux (3.7, `set-clipboard on`) passes it through and kitty (`clipboard_control write-clipboard`) accepts it; docs/config.md already says what's needed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Karl-Einar Bergstrøm <karl-einarb@outlook.com>
Reviewed-on: #19

docs/databricks.md

@@ -17,10 +17,6 @@ When Databricks refuses, the pane says what to check: access to the
 workspace and READ on the scope, or, when the workspace's IP access list
 refused, the network you're on.
 
-On a scope, the right pane shows who has access to it and how much
-(manage, write, read). Databricks shows that only to the scope's
-managers; to others it says so.
-
 Hide profiles you don't want in the [config](config.md):
 
 ```yaml

docs/keys.md

@@ -49,7 +49,7 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field or group |
+| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
@@ -60,6 +60,11 @@ match case exactly.
 | `L` | sign in again (shown when a login has expired) |
 | `U` | a newer lazysecrets: its changelog, and update in place (restart to use it); or look for one |
 
+A revealed value is shown as it reads best: JSON indented, and PEM
+certificates as their subject, issuer, dates, names and thumbprint, with
+any other PEM block (a private key) named but not shown. `y` still copies
+it exactly as stored.
+
 A revealed value hides again after `revealTimeout` (60s) and when the
 terminal loses focus (`hideOnBlur`); see [config](config.md).
 
@@ -114,13 +119,15 @@ it's hidden.
 
 On top, the status pane (`0`) shows the version, a newer release and how
 your accounts are doing. Focused, the right pane lists more under the
-logo (when there's room): the version
-and updates (`U`), each account (`L` on one that needs it signs in), the
-config, state and cache files (`e` opens one in your editor), and links
-to the docs, source, issues, releases and changelog (`o` opens one; on
-the version or update, its release), then the changelog of
-every release up to yours, built in so it needs no network: `/` filters
-it (`/fixed`, `/search`). `y` copies any row.
+logo (when there's room): the version and updates (`U`), each account
+(`L` on one that needs it signs in), what's expiring (`enter` goes to
+it), this session's errors, newest first (what a pane showed, or the
+footer flashed before you moved on; not kept after quitting), the config,
+state and cache files (`e` opens one in your editor), and links to the
+docs, source, issues, releases and changelog (`o` opens one; on the
+version or update, its release), then the changelog of every release up
+to yours, built in so it needs no network: `/` filters it (`/fixed`,
+`/search`). `y` copies any row.
 
 | Key | Action |
 |---|---|