feat: make keepass the default backend with master.kdbx default path

Change default backend from "geheim" to "keepass" and default KDBXPath
from ~/Documents/Keepass/master to ~/Documents/Keepass/master.kdbx.
Existing geheim users must set backend="geheim" in ~/.config/foostore.json.
Update resolveBackend fallback, struct comments, and test assertions to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

4 files changed, 16 insertions, 12 deletions

diff --git a/internal/cli/cli.go b/internal/cli/cli.go
index 75ab078..1f5a736 100644
--- a/internal/cli/cli.go
+++ b/internal/cli/cli.go
@@ -187,7 +187,9 @@ func newCLI(ctx context.Context, backendName, kdbxPath string) (*CLI, error) {
 }
 
 // resolveBackend returns the effective backend name given the flag override and
-// the config value.  flag takes precedence; empty strings fall back to "geheim".
+// the config value.  flag takes precedence; config value is used next; the
+// last-resort default is "keepass" (matching the config.defaultConfigWithHome
+// default so that the two sources of truth stay in sync).
 func resolveBackend(flagValue, cfgValue string) string {
 	if flagValue != "" {
 		return flagValue
@@ -195,7 +197,7 @@ func resolveBackend(flagValue, cfgValue string) string {
 	if cfgValue != "" {
 		return cfgValue
 	}
-	return "geheim"
+	return "keepass"
 }
 
 // buildBackend constructs the Backend and its associated Gitter based on
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index 1661283..4b05487 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -874,7 +874,7 @@ func TestResolveBackend(t *testing.T) {
 	}{
 		{name: "flag wins", flagValue: "keepass", cfgValue: "geheim", want: "keepass"},
 		{name: "config when no flag", flagValue: "", cfgValue: "keepass", want: "keepass"},
-		{name: "default when both empty", flagValue: "", cfgValue: "", want: "geheim"},
+		{name: "default when both empty", flagValue: "", cfgValue: "", want: "keepass"},
 		{name: "flag overrides empty config", flagValue: "geheim", cfgValue: "", want: "geheim"},
 	}
 
diff --git a/internal/config/config.go b/internal/config/config.go
index 3b4bed4..f0cc6f0 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -22,8 +22,8 @@ const (
 
 // Config holds all application-wide configuration values.
 // JSON field names use snake_case to match the original geheim.rb Config::DEFAULTS keys.
-// The Backend field selects the storage backend: "geheim" (default, encrypted
-// .index/.data files in a git repo) or "keepass" (a .kdbx database file).
+// The Backend field selects the storage backend: "keepass" (default, a .kdbx
+// database file) or "geheim" (encrypted .index/.data files in a git repo).
 type Config struct {
 	DataDir           string   `json:"data_dir"`
 	ExportDir         string   `json:"export_dir"`
@@ -36,10 +36,10 @@ type Config struct {
 	MacOSClipboardCmd string   `json:"macos_clipboard_cmd"`
 	SyncRepos         []string `json:"sync_repos"`
 
-	// Backend selects the storage backend: "geheim" (default) or "keepass".
+	// Backend selects the storage backend: "keepass" (default) or "geheim".
 	Backend string `json:"backend"`
 	// KDBXPath is the path to the KeePass .kdbx database file.
-	// Defaults to ~/Documents/Keepass/master to match migrate-kdbx defaults.
+	// Defaults to ~/Documents/Keepass/master.kdbx.
 	KDBXPath string `json:"kdbx_path"`
 	// KDBXKeyFile is the optional path to a KeePass key file.
 	// An empty value disables key file authentication.
@@ -115,12 +115,14 @@ func defaultConfigWithHome(home string) Config {
 		MacOSClipboardCmd: "pbcopy",
 		SyncRepos:         []string{"git1", "git2"},
 
-		// Backend defaults match the geheim (original) storage backend.
+		// Backend defaults to "keepass" so new users get the KeePass backend
+		// out of the box.  Existing geheim users must set backend="geheim" in
+		// ~/.config/foostore.json to keep their existing behaviour.
 		// KDBXPath and KDBXPassFile defaults mirror the migrate-kdbx command
 		// at internal/cli/migrate_kdbx.go so users who already use that command
 		// have zero additional configuration to provide.
-		Backend:      "geheim",
-		KDBXPath:     filepath.Join(home, "Documents", "Keepass", "master"),
+		Backend:      "keepass",
+		KDBXPath:     filepath.Join(home, "Documents", "Keepass", "master.kdbx"),
 		KDBXKeyFile:  "",
 		KDBXPassFile: filepath.Join(home, ".master.pass"),
 	}
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 7ffcc68..eac7340 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -296,8 +296,8 @@ func TestLoad_backendDefaults(t *testing.T) {
 	cfg := Load()
 
 	cases := []struct{ name, got, want string }{
-		{"Backend", cfg.Backend, "geheim"},
-		{"KDBXPath", cfg.KDBXPath, filepath.Join(dir, "Documents", "Keepass", "master")},
+		{"Backend", cfg.Backend, "keepass"},
+		{"KDBXPath", cfg.KDBXPath, filepath.Join(dir, "Documents", "Keepass", "master.kdbx")},
 		{"KDBXKeyFile", cfg.KDBXKeyFile, ""},
 		{"KDBXPassFile", cfg.KDBXPassFile, filepath.Join(dir, ".master.pass")},
 	}