feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/cli/src/out.ts

@@ -1,3 +1,4 @@
+import * as p from "@clack/prompts";
 import pc from "picocolors";
 
 export function isJson(options: { json?: boolean }): boolean {
@@ -28,6 +29,21 @@ export function fail(error: unknown): never {
   process.exit(1);
 }
 
+/** Spinner for multi-hundred-ms work (Argon2 derives). Silent when piped. */
+export async function withSpinner<T>(message: string, work: () => Promise<T>): Promise<T> {
+  if (!process.stdout.isTTY) return work();
+  const s = p.spinner();
+  s.start(message);
+  try {
+    const result = await work();
+    s.stop(message);
+    return result;
+  } catch (error) {
+    s.stop(pc.red("failed"));
+    throw error;
+  }
+}
+
 /** Minimal column printer — left-aligned, two-space gutter. */
 export function printTable(headers: string[], rows: string[][]): void {
   const all = headers.length ? [headers, ...rows] : rows;