feat: this session's errors in the status pane, newest first

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/keys.md

@@ -49,7 +49,7 @@ match case exactly.
 | Key | Action |
 |---|---|
 | `space` | reveal / hide the selected value (public material for keys and certificates) |
-| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field or group |
+| `y` | copy the value without revealing it; cleared from the clipboard after 30s. On an Azure account's row: its object ID; in its pane, the selected field |
 | `Y` | copy the reference (`@Microsoft.KeyVault(...)`, key/certificate URL, `{{secrets/scope/key}}`) |
 | `v` | versions of the selected item (Azure); `space`/`y`/`Y` then act on that version; `esc`, `⌫` or `v` to go back |
 | `o` | open the selected item in the browser (over SSH: copy the link) |
@@ -60,6 +60,11 @@ match case exactly.
 | `L` | sign in again (shown when a login has expired) |
 | `U` | a newer lazysecrets: its changelog, and update in place (restart to use it); or look for one |
 
+A revealed value is shown as it reads best: JSON indented, and PEM
+certificates as their subject, issuer, dates, names and thumbprint, with
+any other PEM block (a private key) named but not shown. `y` still copies
+it exactly as stored.
+
 A revealed value hides again after `revealTimeout` (60s) and when the
 terminal loses focus (`hideOnBlur`); see [config](config.md).
 
@@ -114,13 +119,15 @@ it's hidden.
 
 On top, the status pane (`0`) shows the version, a newer release and how
 your accounts are doing. Focused, the right pane lists more under the
-logo (when there's room): the version
-and updates (`U`), each account (`L` on one that needs it signs in), the
-config, state and cache files (`e` opens one in your editor), and links
-to the docs, source, issues, releases and changelog (`o` opens one; on
-the version or update, its release), then the changelog of
-every release up to yours, built in so it needs no network: `/` filters
-it (`/fixed`, `/search`). `y` copies any row.
+logo (when there's room): the version and updates (`U`), each account
+(`L` on one that needs it signs in), what's expiring (`enter` goes to
+it), this session's errors, newest first (what a pane showed, or the
+footer flashed before you moved on; not kept after quitting), the config,
+state and cache files (`e` opens one in your editor), and links to the
+docs, source, issues, releases and changelog (`o` opens one; on the
+version or update, its release), then the changelog of every release up
+to yours, built in so it needs no network: `/` filters it (`/fixed`,
+`/search`). `y` copies any row.
 
 | Key | Action |
 |---|---|