fix(vault): migrating a vault with no key yet says so instead of claiming a verified move

On a fresh profile `hermes vault key migrate` only records vault.key_storage;
no key exists to move or decrypt. The CLI now says no key exists yet and where
the first saved item will create one.

Review: Greptile on b322737dfd.

hermes_cli/vault.py

@@ -196,7 +196,10 @@ def _cmd_key(args) -> None:
             return
         store.migrate_key(target)
         _set_key_storage(target)
-        if target == "keychain":
+        if store.key_location()["storage"] == "none":  # nothing was moved or verified, only the setting
+            c.print(f"No vault key exists yet. The first saved item creates one in "
+                    f"{'the OS keychain' if target == 'keychain' else 'vault.key'} (vault.key_storage = {target}).")
+        elif target == "keychain":
             c.print(f"[green]Vault key moved to the OS keychain[/] ({vault_keychain.backend_label()}); "
                     "vault.key was removed after the keychain copy decrypted the vault.")
             c.print("[dim]Backups of this profile now hold the encrypted vault without its key; "

tests/hermes_cli/test_vault_key_cli.py

@@ -64,3 +64,13 @@ def test_vault_key_migrate_moves_the_key_and_records_the_choice(hermes, capsys):
     assert (home / "vault" / "vault.key").exists() and backend.entries == {}
     assert load_config()["vault"]["key_storage"] == "file"
     assert VaultStore().resolve_secret(item)["password"] == "dummy-pw-cli-9"
+
+
+@pytest.mark.parametrize("target", ["keychain", "file"])
+def test_migrating_an_empty_vault_says_no_key_exists_yet(hermes, capsys, target):
+    run, backend, home = hermes
+    run("key", "migrate", "--to", target)
+    out = capsys.readouterr().out
+    assert "No vault key exists yet" in out
+    assert "decrypted" not in out and "moved" not in out, "nothing was moved or verified"
+    assert backend.entries == {} and not (home / "vault" / "vault.key").exists()