feat(vault): create/edit card ciphers (write path)

[UnbreakableMJ]

What

Makes card (type 3) ciphers writable via the CLI: vault add --type card … and vault edit <card> …. Cards were already readable end-to-end (PRs #23/#24) but add/edit only built logins and secure notes.

Non-secret fields (cardholder, brand, expiry) are plain flags; the card number and CVV are read from /dev/tty, never passed as argv (same convention as --password — flags leak to shell history / ps).

How

• vault-ipc — typed CardWrite (one Option per field, serving both add None=unset and edit Some=set; number/code are secret Vec<u8> with a hand-written Debug that redacts them). Rides a #[serde(default)] card on Request::Add/Edit (forward-compatible). Transport round-trip test.
• vault-core — from_plain emits a Card for cipher_type == 3, the exact inverse of the read-path decrypt. from_plain→decrypt card round-trip test.
• vault-agent — add_cipher decodes the secret bytes (zeroizing) into a PlainCard before from_plain; apply_cipher_edits sets only the given card fields (get-or-insert a Card, encrypt-on-change), and rejects card edits on a non-card item. Unit-tested.
• vault-cli — KindArg::Card, --cardholder/--brand/--expiry flags, --number/--code bool flags gating tty prompts; split_expiry parses MM/YYYY or MM/YY.
• vault-tui — threads the new card: None through its Add/Edit request literals.
• docs — README card create/edit note, CHANGELOG entry.

Verification

cargo fmt --check, fresh-isolated clippy -D warnings (pedantic+nursery), cargo test --workspace --all-targets, cargo deny check, and both headless builds all clean.

Out of scope (tracked follow-ups)

• Identity create/edit (the immediate next slice — ~18 fields, larger CLI surface).
• TUI-side card/identity editing (CLI-only writes, as today for all types).

🤖 Generated with Claude Code