Expose the vault in the CLI

[ergofobe]

The SDK and server have full vault support, but the CLI has no imogen vault subcommand at all.

SDK surface (imogen-sdk/rust/src/vault.rs):

• status() -> VaultStatus
• set_passphrase(passphrase: &str) — vault setup
• unlock(passphrase: &str)
• lock()
• list(limit: u32) -> AssetPage — capped sample, total field shows the real size
• timeline(covers) / timeline_bucket(period, cursor, limit) — for walking the whole vault the way imogen album show --all walks an album
• move_in(selection: &AssetSelection) -> MovedCount
• move_out(selection: &AssetSelection) -> MovedCount

Server routes live in packages/server/src/api/vault.ts (main imogen repo).

Sketch of the CLI shape, following the existing imogen album / imogen people conventions:

imogen vault status                 # locked/unlocked, passphrase set or not, asset count
imogen vault setup                  # prompts for a passphrase, calls set_passphrase
imogen vault unlock                 # prompts for the passphrase, calls unlock
imogen vault lock
imogen vault list [--limit N]       # ls-style table/JSON of the capped sample, notes the real total
imogen vault in <ids...> [--query ...] [-y]   # move_in, mirrors `album add`'s id/query selection
imogen vault out <ids...> [--query ...] [-y]  # move_out, mirrors `album remove`

in/out should reuse the id/query AssetSelection pattern from imogen trash/imogen restore (explicit ids chunked at 500 per request; a filter sent as AssetSelection { query, except } with the resolved count shown in the confirmation prompt) rather than reinventing selection handling.

Passphrase prompts should not echo to the terminal (existing rpassword-style pattern, or add the dependency if none exists yet) and must never be logged or included in --json output.

Not implementing this issue — filed as a tracking issue per an audit of imogen-cli's selection semantics (see PR against main from that audit).