feat(vault): card & identity cipher types (read, CLI)

[UnbreakableMJ]

What

Vault modeled the login cipher fully but left card (type 3) and
identity (type 4) ciphers structureless — vault get couldn't reach a card
number or an identity's email. This slice models them in vault-core and
exposes the high-value fields via the CLI:

vault get visa --field card-number   # + card-brand, card-expiry, card-code
vault get me   --field identity-email # + identity-name, identity-phone, identity-address

Rendering card/identity in the TUI detail pane is the next slice (decided
with you) — List/ListEntry carry only name/username today, so the TUI needs
on-demand fetches, handled separately.

How

• vault-core: Card + Identity structs (full field sets) on Cipher;
  PlainCard/PlainIdentity decrypted mirrors on PlainCipher (sensitive
  fields — card number/code, identity ssn/passport/license — zeroized on drop);
  DecryptOptions { card, identity } + decrypt loops reusing decrypt_optional.
• vault-ipc: new Field selectors (CardNumber/CardBrand/CardExpiry/
  CardCode, IdentityName/IdentityEmail/IdentityPhone/IdentityAddress).
• vault-agent: get_item maps them and composes the derived ones
  (card-expiry → MM/YYYY; identity name/address joined); absent →
  NoSuchField. The Copy path inherits it.
• vault-cli: matching FieldArg variants (clap kebab-cases them).

Scope / follow-ups

Read path only. Out of scope (tracked): the TUI detail render, creating/
editing cards & identities (from_plain), and per-field selectors for the
long-tail identity fields (ssn/passport/license/company/address parts — modeled
and decryptable, just not individually selectable).

Tests

• vault-core: decrypt a card (number/brand/exp/code) and an identity
  (name/email/phone/address) from EncStrings; un-asked sub-objects stay None.
• vault-agent: get_item(CardNumber) returns the number, CardExpiry →
  04/2030, missing field → NoSuchField.
• vault-ipc: a Get/Field round-trip for a new variant.

Local CI-exact gates all green: fmt, fresh isolated clippy -D warnings,
cargo test --workspace --all-targets under RUSTFLAGS=-D warnings,
cargo deny check (no new deps), both headless builds.

🤖 Generated with Claude Code