refactor: extract migration logic into internal/migrate package (task q6)

Move all geheim→KeePass migration business logic from internal/cli/migrate_kdbx.go
into a new internal/migrate package (migrator.go, kdbx_store.go). The CLI layer
is now a thin orchestrator: parse flags, open KDBX, call migrate.Run, save, report.

Key design decisions:
- migrate.Run accepts separate logFn (stdout info) and warnFn (stderr errors)
  so per-entry errors correctly route to stderr via warn(), not stdout via logMsg()
- migrate.Options contains only DryRun; DBPath/BinaryOutDir removed (CLI-only concerns)
- StoreWalker interface is narrow, avoiding a direct dependency on backend.Backend
- cli_paths.go extracts readPasswordFile/resolveHomeDir/expandHome shared within cli
- kdbx_store.go deleted from cli (moved to internal/migrate)
- Duplicate TestExtractPasswordFromContent removed from kdbx_store_test.go
- Custom contains/containsStr helpers replaced with strings.Contains in tests
- Dry-run test now asserts logged message content

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

1 files changed, 0 insertions, 9 deletions

diff --git a/internal/cli/kdbx_store_test.go b/internal/cli/kdbx_store_test.go
index bff1a0a..035c03c 100644
--- a/internal/cli/kdbx_store_test.go
+++ b/internal/cli/kdbx_store_test.go
@@ -25,12 +25,3 @@ func TestSanitizeRelativePathRejectsTraversal(t *testing.T) {
 	}
 }
 
-func TestExtractPasswordFromContent(t *testing.T) {
-	password, notes := extractPasswordFromContent("user: alice\npassword: s3cr3t\nurl: example.com\n")
-	if password != "s3cr3t" {
-		t.Fatalf("password = %q; want s3cr3t", password)
-	}
-	if notes != "user: alice\nurl: example.com" {
-		t.Fatalf("notes = %q; want without password line", notes)
-	}
-}