#3003 vault migrate: report missing required --config fields clearly, before installing the target type

Problem

swamp vault migrate <vault> --to-type <type> without --config fails with a raw Zod dump when the target type has required config fields. It fails only after it resolves the type and installs it from the registry.

Repro (swamp 20260927.012109.0-sha.6860a5b7, migrating a local_encryption vault):

$ swamp vault migrate cloudflare --to-type @swamp/1password
  Resolving   @swamp/1password not found locally, searching registry...
 Installing   @swamp/1password@2026.09.10.0 (...)
  Installed   @swamp/1password@2026.09.10.0 (7 models registered)

Error: Invalid config for vault type '@swamp/1password': [
  {
    "expected": "string",
    "code": "invalid_type",
    "path": ["op_vault"],
    "message": "Invalid input: expected string, received undefined"
  }
]

The behavior is safe: the source vault is not changed. But:

1. The error does not name the fix. It does not mention --config, and the user must read the Zod output to find the field name.
2. The check runs late. The schema is known once the type resolves, but swamp installs the extension first and then reports the error.
3. Nothing in the flow points to --config. The user who hit this did not know the flag existed.

Proposed solution

• Turn the schema failure into a short message. Name each missing required field, with its description if the schema has one, and show an example command, e.g.: @swamp/1password requires config field 'op_vault' (1Password vault name). Re-run with --config '{"op_vault":"<name>"}'.
• In an interactive terminal (no --json, no --yes), prompt for missing required string fields instead of failing.
• Check the config as soon as the type schema is available, before the install (or at least before any other work).

The same handling probably applies to swamp vault create <type> <name> when required config is missing.

Alternatives

Rely on docs and swamp help vault migrate. The help already lists --config, but nothing in the failure path sends the user there.