¿Puedo vibecodear 1Password?

Build me a local encrypted password vault to replace 1Password, CLI-first. Requirements:

- A single-binary CLI in Go using filippo.io/age for encryption and Argon2id
  (golang.org/x/crypto) to derive the key from my master passphrase. Use the
  library primitives exactly as documented, invent no crypto.
- The vault is one encrypted file at ~/.vault/vault.age holding JSON entries:
  name, username, password, URL, notes, updated timestamp.
- Commands: add, get <name> (copies to clipboard, clears it after 20 seconds),
  ls, gen (32-char random password), edit, rm.
- Fuzzy name matching on get; never print a password to stdout unless --show
  is passed.
- vault backup writes a date-suffixed copy of the encrypted file to a folder
  set in .env; it is already encrypted, so any cloud drive can sync it.
- Import from a 1Password CSV export so I can migrate in one command.
- Everything local: no server, no accounts, no telemetry.
- Out of scope: browser autofill, passkeys, and secure sharing. Those are why
  people pay 1Password; if I need them the honest move is KeePassXC or
  Bitwarden, say exactly that in the README.
- README: a five-line threat model, how key derivation works, and a warning
  that losing the master passphrase loses everything, there is no recovery.