feat(agent): fingerprint unlock (Linux/fprintd, off by default) (#48)

`vault unlock --fingerprint` (and a TUI unlock-screen mode) re-unlock the
keyring-held session after a fingerprint verified over D-Bus to the system
`fprintd`, instead of re-typing the master password.

This builds on the opt-in `agent.session_keyring`: a fingerprint yields only
match/no-match, never key material, so it *gates the resume* of the key already
in the kernel session keyring rather than wrapping a key at rest. With
`agent.fingerprint_unlock` on, the agent no longer silently auto-resumes (it
waits for a verified touch), idle-lock zeroises the in-memory key but KEEPS the
keyring entry so a touch works after a timeout (lifetime
`agent.fingerprint_ttl_secs`), and a manual `vault lock` still clears it.
Verification happens inside the agent so a client can't bypass it over the
socket; enrollment stays OS-level (`fprintd-enroll`) — Vault stores no template.

Posture (PRD §7.3): the keyring entry is possessor-gated, so this is convenience
+ user-presence, NOT a cryptographic boundary beyond `session_keyring`, and
strictly weaker than a master-password unlock. Default off, Linux-only, behind a
new off-by-default `fingerprint` cargo feature (zbus).

- vault-ipc: `Request::UnlockFingerprint` + `FingerprintUnavailable`/`Failed`
- vault-config: `agent.fingerprint_unlock` / `fingerprint_ttl_secs` + spawn flags
- vault-agent: fprintd zbus client (`fingerprint.rs`), dispatch, idle-lock/resume
  gating, `resume_from_keyring` helper
- vault-cli: `vault unlock --fingerprint`
- vault-tui: unlock-screen fingerprint mode (Tab cycles password/PIN/fingerprint)
- docs/fingerprint.md, PRD §7.3, CHANGELOG, `just fingerprint`

Tests cover config round-trip + flags, the resume gate, and the TUI mode/request.
Full `just ci` green (clippy `--all-features` incl. the feature; deny/audit clean
with zbus). Verified live: CLI fingerprint unlock against a real reader.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: UnbreakableMJ

CHANGELOG.md

@@ -76,6 +76,20 @@ range may break in any release.
 
 ### Added
 
+- **Fingerprint unlock (Linux, off by default).** With `agent.session_keyring`
+  and the new `agent.fingerprint_unlock` enabled, `vault unlock --fingerprint`
+  (and a TUI unlock-screen mode) re-unlock the keyring-held session after a
+  fingerprint verified — inside the agent, over D-Bus to the system `fprintd`
+  (via the new off-by-default `fingerprint` cargo feature + `zbus`). Idle-lock
+  zeroises the in-memory key but **keeps** the keyring entry so a touch works
+  after a timeout (lifetime: `agent.fingerprint_ttl_secs`); the agent no longer
+  silently auto-resumes, and manual `vault lock` still clears everything.
+  Enrollment stays OS-level (`fprintd-enroll`); Vault only verifies and stores
+  no template. **Posture (PRD §7.3):** this is convenience + user-presence, not
+  a cryptographic boundary — the keyring entry is possessor-gated, so it's no
+  stronger than `session_keyring` and weaker than a master-password unlock. See
+  `docs/fingerprint.md`.
+
 - **Organization / Collection items now decrypt (org-key support).** Vault
   previously skipped every organization-owned cipher — the bulk of a vault that
   uses Collections — because it held no key for them. At unlock the agent now