feat(cli): unlock resolves second factor from params hint (image|keyfile)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01McMF5pUJbCMricmFEnf2sG

crates/relicario-cli/tests/keyfile_flows.rs

@@ -0,0 +1,40 @@
+use assert_cmd::prelude::*;
+use std::process::Command;
+
+fn relicario(dir: &tempfile::TempDir) -> Command {
+    let mut cmd = Command::cargo_bin("relicario").unwrap();
+    cmd.current_dir(dir.path());
+    cmd
+}
+
+/// Full round-trip: init a vault with a key file, then add + get an item using
+/// RELICARIO_KEYFILE. Ignored until Task 5 lands `init --key-file`.
+#[test]
+#[ignore = "un-ignored in Task 5 once init --key-file lands"]
+fn init_keyfile_then_unlock_keyfile_round_trips() {
+    let dir = tempfile::tempdir().unwrap();
+
+    // init with a key file (Task 5 wires the flag)
+    relicario(&dir)
+        .args(["init", "--key-file", "vault.relkey"])
+        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
+        .assert()
+        .success();
+
+    // add an item using the generated key file
+    relicario(&dir)
+        .args(["add", "login", "--title", "gh", "--username", "u", "--password", "p"])
+        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
+        .env("RELICARIO_KEYFILE", dir.path().join("vault.relkey"))
+        .assert()
+        .success();
+
+    // get the item — username "u" must appear in stdout
+    relicario(&dir)
+        .args(["get", "gh", "--show"])
+        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
+        .env("RELICARIO_KEYFILE", dir.path().join("vault.relkey"))
+        .assert()
+        .success()
+        .stdout(predicates::str::contains("u"));
+}