fix(cli): resolve second factor via shared helper for recovery-qr + backup (key-file parity); wasm equivalence negative control

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McMF5pUJbCMricmFEnf2sG

crates/relicario-cli/tests/keyfile_flows.rs

@@ -121,6 +121,24 @@ fn init_without_a_factor_fails() {
         .stderr(predicates::str::contains("either --image"));
 }
 
+/// recovery-qr generate must work for a key-file vault (was broken: it hard-coded image extraction).
+#[test]
+fn recovery_qr_generate_works_for_keyfile_vault() {
+    let dir = tempfile::tempdir().unwrap();
+    relicario(&dir)
+        .args(["init", "--key-file", "vault.relkey"])
+        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
+        .assert()
+        .success();
+    relicario(&dir)
+        .args(["recovery-qr", "generate"])
+        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
+        .env("RELICARIO_KEYFILE", dir.path().join("vault.relkey"))
+        .assert()
+        .success()
+        .stdout(predicates::str::contains("Recovery QR generated"));
+}
+
 /// --image and --key-file are mutually exclusive (clap rejects before the handler).
 #[test]
 fn init_with_both_factors_fails() {