install.md only covered generating a brand-new key during fresh setup. Added the actual recovery path (retrieve the existing key from the sops-age secret) - what today's session actually needed after the Mac reinstall. Also flags the age key's single-backup-location weakness, tracked in issue #20.