CLI tool that generates ML-KEM-768 + X25519 hybrid age keys and produces single-page printable HTML backups with QR codes. Designed for SOPS disaster recovery. Runs in a hardened Docker container (no network, read-only fs, no capabilities, distroless image). Written in Go.