feat(vault-agent): scheduled background sync

[UnbreakableMJ]

What

New sync.interval_secs config key. While the agent is unlocked, it re-pulls
/sync on that cadence, refreshing the in-memory vault and the encrypted
on-disk cache — so a long-running session never drifts from the server, and an
offline/PIN unlock later reads fresh data, with no manual vault sync.
0/unset disables.

How

• server::scheduled_sync_loop — a tokio interval task modeled on the
  existing idle_lock_loop; spawned from main.rs only when
  --sync-interval-secs > 0. Each tick, if unlocked, it calls
  AgentState::resync (the same path vault sync uses: ensure_online →
  /sync → replace ciphers/folders/last_sync → re-persist cache).
• Best-effort: a Locked / Offline / network result is logged and
  skipped — a failed background sync never disturbs the session.
• Does not touch() — a background sync must not reset the idle-lock
  countdown, so idle-lock still fires on schedule; once locked, the loop skips.
• Config → flag like idle_lock_secs: sync.interval_secs →
  --sync-interval-secs, applied on the next agent (auto-)spawn.
• last_sync (already in vault status) surfaces freshness — no protocol
  change.

Tests

• vault-config: sync.interval_secs get/set/unset round-trip + agent_args
  emits --sync-interval-secs <n> only when set.
• vault-agent: an invariant test that a locked resync returns Locked
  (clean skip) and leaves last_activity untouched (background sync doesn't
  defer idle-lock).

Local CI-exact gates all green: fmt, fresh isolated clippy -D warnings,
cargo test --workspace --all-targets under RUSTFLAGS=-D warnings,
cargo deny check (no new deps), both headless builds.

🤖 Generated with Claude Code