feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/db/queries/project_secrets.sql

@@ -0,0 +1,36 @@
+-- name: ListProjectSecrets :many
+SELECT id, project_id, name, url, notes, created_at, updated_at
+FROM core.project_secrets
+WHERE project_id = $1
+ORDER BY name ASC;
+
+-- name: GetProjectSecret :one
+SELECT * FROM core.project_secrets
+WHERE project_id = $1
+  AND name = $2;
+
+-- name: UpsertProjectSecret :one
+INSERT INTO core.project_secrets (
+  project_id,
+  name,
+  ciphertext,
+  url,
+  notes
+) VALUES ($1, $2, $3, $4, $5)
+ON CONFLICT (project_id, name) DO UPDATE SET
+  ciphertext = EXCLUDED.ciphertext,
+  url = EXCLUDED.url,
+  notes = EXCLUDED.notes,
+  updated_at = NOW()
+RETURNING *;
+
+-- name: DeleteProjectSecret :one
+DELETE FROM core.project_secrets
+WHERE project_id = $1
+  AND name = $2
+RETURNING id;
+
+-- name: ListProjectSecretValues :many
+SELECT name, ciphertext
+FROM core.project_secrets
+WHERE project_id = $1;