feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/mcp/README.md

@@ -21,3 +21,14 @@ config file - `primora login` once and both tools work. Env vars override:
 collections, API keys, integrations, webhooks, scheduled jobs, telemetry,
 and audit: `primora_whoami`, `primora_list_projects`,
 `primora_upload_object`, `primora_query_audit`, `primora_run_job`, …
+
+Secrets are agent-safe by design — values are never returned by any tool:
+
+- `primora_vault_status` / `primora_vault_list` — local-vault state and
+  metadata (names/urls/notes only); requires `primora vault unlock` on the host.
+- `primora_vault_exec` — runs `primora` commands with a vault secret injected
+  into the child's env; `vault`/`secrets`/`inject`/`agent`/`login`/`use` and
+  `keys:create` are denied so no response can carry a credential.
+- `primora_secrets_list` / `primora_secrets_set` — project-vault metadata and
+  write-only storage. No reveal or delete: agents consume secrets through
+  `secret://NAME` references in job payloads, resolved server-side at delivery.