Add unit tests for CLI without ansible-vault dependency

[f3rdy]

Description

All 17 CLI tests depend on the external ansible-vault binary. Without it installed, the entire CLI test suite is skipped. This creates a fragile test setup.

Proposed Solution

• Mock decrypt_vault and encrypt_vault from vault.py in CLI tests
• Keep existing tests as integration tests with pytest.mark.integration
• New unit tests in test_cli_unit.py that run without ansible-vault

Acceptance Criteria

• CLI logic is testable without ansible-vault installed
• Existing integration tests still work when ansible-vault is available
• init command has test coverage (currently 0%)
• Coverage for cli.py improves from 72% to >85%

Priority

P1 — must fix