Critical fixes:
- Fix broken decryption: io.Reader read into zero-length buffer (GPG, AES, SSH, Gist)
- Fix AES-256 key derivation: re-derive key from stored salt during decryption
- Fix AddRecipientAction: append was inside loop, adding recipient N times
- Fix RemoveRecipientAction: filter kept the wrong variable, inverting logic
- Fix GetPassphrase: returned empty local variable instead of config value
- Fix DelAction: vault.Lock return value was silently discarded

Security:
- Add HostKeyCallback to SSH client to prevent MITM attacks
- Sanitize remote path in SSH Pull to prevent command injection
- Set store file permissions to 0600 (owner-only) instead of 0700/0755
- Set config file permissions to 0600

Other:
- Align environment variable names with README documentation
- Skip config/store setup when displaying --help
- Pass config file path through to config.Load (TOML config was ignored)
- Simplify prependSalt implementation
- Fix typo in before.go error message