feat(cli): make agentkeys init idempotent

[YoshiyukiSakura]

Change:

• Implements the Stage 8 CLI defensive deliverable for idempotent agentkeys init.
• Adds agentkeys init --force to intentionally re-run initialization when a usable local session already exists.
• Keeps existing library callers compatible through cmd_init, with cmd_init_with_force for forced paths.

Objective Evidence:

• cargo fmt --check (exit code 0)
• cargo test -p agentkeys-cli init_ (exit code 0)
• cargo test -p agentkeys-cli --tests (exit code 0)

Visual Evidence:

• n.a.

Reviewer:

• @repo Intake Reviewer

Risks / Not Covered:

• Visual evidence is n.a. because this is a CLI-only defensive behavior change with no product UI surface or source screenshot.
• This PR intentionally covers only the idempotent init + force CLI slice from issue Stage 8: Production hardening — daemon memory hygiene + CLI defensive features #3.
• Remaining Stage 8 daemon memory-hygiene deliverables are not implemented here.

Refs #3

[hanwencheng]

Pushed a small follow-up to this branch (63b492c) addressing one point from review.

What changed — the idempotent path now names the override in its own output:

- Already initialized as 0x1234…
+ Already initialized as 0x1234…. Run 'agentkeys init --force' to re-initialize.

Why — this repo's standing preference is auto-detect over flags; never make the operator recall a flag (the CLAUDE.md "idempotent remote-setup" rule, e.g. why we never pass --upgrade). The idempotent default here is exactly right and needs no flag, so that part is great.

--force itself is worth keeping: its intent — deliberately discarding a still-valid session (switching identity, recovering a suspected-bad-but-unexpired session) — is not derivable from state, so unlike --upgrade/--with-mcp it can't be auto-detected, and idempotency needs exactly one escape hatch. (The expired/invalid/missing cases already re-init with no flag.)

The only gap was that a dead-end "Already initialized" message forced the operator to remember the flag. Now the tool surfaces it at the moment of need — zero memory required, default stays flagless.

cargo fmt --check + cargo test -p agentkeys-cli init_ green (3 passed); the idempotent-init test assertion was updated to match.

Non-blocking follow-up (optional): is_usable_session's expiry branch (created_at != 0 && expired) has no unit coverage — InProcessBackend hardcodes created_at: 0, so the tests only exercise the "usable" shortcut, while the real broker path (build_session_from_jwt, 5h TTL) does set a real timestamp. A test that persists a Session { created_at: now - ttl - 1, .. } and asserts init re-initializes would pin that security-relevant branch.