BUG: Missing PGPKeySource validation in config

[andrinoff]

Describe the bug: PGPKeySource field accepts any string but no validation when loading config.

To reproduce:

1. Edit config.json, set pgp_key_source: "invalid"
2. Load config - no error
3. Later code assumes valid value

Expected behavior: Validate on config load to ensure value is "file" or "yubikey" only.

Additional context:

• File: config/config.go
• Severity: Low
• Fix: Add validation function