Merge branch 'feat/expiring' into feat/l-for-details

# Conflicts:
#	docs/azure.md
#	internal/ui/app/app_test.go

docs/azure.md

@@ -65,6 +65,26 @@ key (PEM public key) or certificate; private key material is never
 fetched. `v` lists an item's versions. Items expiring within
 `expiryWarningDays` (30 by default) are marked `⚠ 12d`, expired ones `✗`.
 
+The status pane (`0`) lists them across every vault loaded, opened or
+cached, soonest first, and its line counts them (`⚠ 3 expiring`); `enter`
+on one goes to it. That makes no requests of its own: expiry dates come
+with the lists. It says how many vaults it covers; `ctrl+a` in search
+loads the rest.
+
+For a pipeline or a cron job, `lazysecrets expiring` lists them in every
+vault of every account, loading each vault's lists (a few at a time), and
+exits 1 when it lists anything:
+
+```sh
+$ lazysecrets expiring --days 30
+LEFT     EXPIRES     TYPE         VAULT        NAME     LINK
+expired  2026-03-01  certificate  kv-app-prod  old-tls  lazysecrets://azure/kv-app-prod.vault.azure.net/certificates/old-tls
+12d      2026-10-23  secret       kv-app-prod  api-key  lazysecrets://azure/kv-app-prod.vault.azure.net/secrets/api-key
+```
+
+`--days` defaults to `expiryWarningDays`. Lists it can't read are named on
+stderr.
+
 On a vault, the right pane shows its settings: resource group, location,
 SKU, whether access is by Azure roles or access policies, soft delete and
 purge protection, which networks can reach it, private endpoints and tags.