refactor: extract migration logic into internal/migrate package (task q6)

Move all geheim→KeePass migration business logic from internal/cli/migrate_kdbx.go
into a new internal/migrate package (migrator.go, kdbx_store.go). The CLI layer
is now a thin orchestrator: parse flags, open KDBX, call migrate.Run, save, report.

Key design decisions:
- migrate.Run accepts separate logFn (stdout info) and warnFn (stderr errors)
  so per-entry errors correctly route to stderr via warn(), not stdout via logMsg()
- migrate.Options contains only DryRun; DBPath/BinaryOutDir removed (CLI-only concerns)
- StoreWalker interface is narrow, avoiding a direct dependency on backend.Backend
- cli_paths.go extracts readPasswordFile/resolveHomeDir/expandHome shared within cli
- kdbx_store.go deleted from cli (moved to internal/migrate)
- Duplicate TestExtractPasswordFromContent removed from kdbx_store_test.go
- Custom contains/containsStr helpers replaced with strings.Contains in tests
- Dry-run test now asserts logged message content

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/internal/cli/cli_backend.go b/internal/cli/cli_backend.go
index 698c9f3..6a19427 100644
--- a/internal/cli/cli_backend.go
+++ b/internal/cli/cli_backend.go
@@ -147,7 +147,7 @@ func readKeepassPassphrase(cfg *config.Config) (string, error) {
 	}
 
 	// 2. KDBXPassFile — a file containing the password (trimmed of newlines).
-	// readPasswordFile is defined in migrate_kdbx.go and shared here.
+	// readPasswordFile is defined in cli_paths.go and shared across this package.
 	if cfg.KDBXPassFile != "" {
 		pass, err := readPasswordFile(cfg.KDBXPassFile)
 		if err != nil {