fix(commands): make the scan status chain exhaustive

[ogundeleoluwaferanmi35]

Summary

Closes #11. runScan in src/commands/scan.ts logged a line per key with an if / else if / else over reading.status: ok, then low, then everything else treated as archived. A fourth TtlStatus variant would compile cleanly and be silently mislabelled "archived" — and since scan's exit code is what people wire into shell checks, a silent mislabel is worse than a failed build. The issue's description matches the code exactly; no discrepancy found.

What changed

• src/commands/scan.ts: the status chain is now explicit — ok, low, archived — and the final else is an exhaustiveness check: const unhandled: never = reading.status; throw new Error(...). Adding a variant to TtlStatus makes that else narrow to the new variant, and assigning it to never fails npm run build instead of falling through.

Key design decisions

• Kept the existing if / else if structure and added one explicit archived branch plus a never-typed else — the smallest diff that makes the chain exhaustive. The throw is unreachable today (classify in src/rpc/ttl.ts only ever returns ok | low | archived) but carries the key description so a future failure names the offending entry.
• Exit-code contract untouched: readings.some((r) => r.status !== "ok") ? 2 : 0.

Acceptance criteria

• Exhaustive chain over TtlStatus — verified by temporarily adding "expiring" to TtlStatus and confirming npm run build fails:

  src/commands/scan.ts(63,13): error TS2322: Type '"expiring"' is not assignable to type 'never'.
  

  (build exit 2). Reverted before submitting.

• Exit-code contract unchanged — 0 when everything is ok, 2 when anything is not; the return line is untouched.

• Verified locally as above by adding a fourth variant; reverted.

Validation

All clean on this branch:

• npm run format:check — all files use Prettier style
• npm run lint — no issues
• npm run build — passes (src + test tsconfigs)
• npm test — 9 files, 100 tests passed

Follow-ups

None. No new dependencies, no config or env changes.

Security note

Read-only change to scan output classification; no signing path, key material, or network behavior touched. scan still never reads LK_KEEPER_KEY.