feat(vault): vault config + vault purge (PRD §7.1) #20

Job	Run time
cargo-deny	37s
rustfmt	5s
headless build (no TUI / clipboard deps)	31s
clippy	27s
vault --version emits §13.2 attribution	53s
test (ubuntu-latest)	35s
test (macos-latest)	1m 6s
cargo-audit	3m 1s
	7m 15s

Provide feedback