Make storage-flush a little safer

[prophile]

storage-flush is currently a porcelain command which can immediately destroy the database. Especially after #66 this might be easy to do by accident. It's currently there so that you can empty the database and refill it with an import.

We should:

1. Add a --flush argument to storage-import,
2. Mark storage-flush as a plumbing command,
3. Add a mandatory --force argument to storage-flush.