feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/desktop/README.md

@@ -28,4 +28,19 @@ npm run bundle --workspace @primora/desktop   # release bundles → src-tauri/ta
   to be a Primora deployment, use the tray's Change Server.
 - macOS blocks plain-HTTP loads to non-localhost hosts (ATS). Use HTTPS, or
   `http://localhost` for a local deployment.
+
+## Secrets Vault
+
+The tray menu's **Secrets Vault…** opens a local window (`ui/vault.html`) for
+the CLI's encrypted vault — init, timed unlock/lock, list with copy-to-clipboard,
+add/delete, `.env` import. Values are never displayed; copy goes straight to the
+clipboard.
+
+The desktop app does not reimplement the vault: IPC commands shell out to the
+`primora` binary on PATH (`PRIMORA_CLI` overrides the binary path). One vault
+file, one crypto implementation — terminal and desktop always agree. Requires
+`npm i -g @primora/cli`; without it the window shows install instructions.
+
+Injection and the credential broker stay CLI-only (`primora inject`,
+`primora agent`).
 - Deep links / push notifications: deliberately omitted — nothing needs them yet.