refactor: extract migration logic into internal/migrate package (task q6)

Move all geheim→KeePass migration business logic from internal/cli/migrate_kdbx.go
into a new internal/migrate package (migrator.go, kdbx_store.go). The CLI layer
is now a thin orchestrator: parse flags, open KDBX, call migrate.Run, save, report.

Key design decisions:
- migrate.Run accepts separate logFn (stdout info) and warnFn (stderr errors)
  so per-entry errors correctly route to stderr via warn(), not stdout via logMsg()
- migrate.Options contains only DryRun; DBPath/BinaryOutDir removed (CLI-only concerns)
- StoreWalker interface is narrow, avoiding a direct dependency on backend.Backend
- cli_paths.go extracts readPasswordFile/resolveHomeDir/expandHome shared within cli
- kdbx_store.go deleted from cli (moved to internal/migrate)
- Duplicate TestExtractPasswordFromContent removed from kdbx_store_test.go
- Custom contains/containsStr helpers replaced with strings.Contains in tests
- Dry-run test now asserts logged message content

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index 4b05487..487907d 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -18,6 +18,7 @@ import (
 	"codeberg.org/snonux/foostore/internal/config"
 	"codeberg.org/snonux/foostore/internal/crypto"
 	"codeberg.org/snonux/foostore/internal/git"
+	"codeberg.org/snonux/foostore/internal/migrate"
 	"codeberg.org/snonux/foostore/internal/shell"
 	"codeberg.org/snonux/foostore/internal/store"
 )
@@ -700,7 +701,7 @@ func TestDispatch_migrateKDBX_writesBinaryAndSavesKDBX(t *testing.T) {
 	fake := &fakeKDBXStore{
 		overwrites: map[string]bool{"notes": true},
 	}
-	c.openKDBX = func(path, password string) (KDBXStore, error) {
+	c.openKDBX = func(path, password string) (migrate.KDBXStore, error) {
 		if path != dbPath {
 			t.Fatalf("openKDBX path = %q; want %q", path, dbPath)
 		}