Add keystore cloud sync documentation

[Redth]

The keystore cloud sync feature has zero user-facing documentation — the README has a single bullet point ("Cloud sync keystores across machines") with no detail on what data gets uploaded, which providers are supported, or how secrets are handled.

This adds docs/keystore-sync.md covering:

• What gets uploaded — keystore file, password, and metadata as three separate secrets
• Supported providers — all 7 (Azure KV, AWS, Google, Azure DevOps, Infisical, 1Password, Vaultwarden/Bitwarden) with auth methods and encryption models
• Local storage — where keystore files, passwords, and provider credentials live on each platform
• Practical considerations — password goes to the cloud, server-side vs client-side encryption differences, use minimal credentials

Also links the new doc from the README's keystore feature section.

Prompted by #135 — though we're skipping the formal SECURITY.md suggestion, the underlying point about missing keystore sync documentation was fair.