feat: purge legacy agent hosts and land vault Chrome extension path

Retire ACP/Hermes/OpenCode surfaces and rename hermes_tools to
mnote_agent_tools so Page AI stays on Pi Lab only. Add Chrome vault
extension + extension token route, pre-release purge design, and soft-retire
legacy smokes for the small-group production cut.

rust/crates/mnote-vault-core/src/ai.rs

@@ -5,8 +5,8 @@ use crate::store::{
     self, append_vault_audit, ensure_vault_directories, get_credential, list_credentials,
     load_cipher_book, login_session_is_fresh, now_rfc3339, project_item_l0_with_cipher,
     project_list_entry_with_cipher, project_secret_revealed, put_login_playbook, put_login_session,
-    resolve_record_secret_field, resolve_secret_with_cipher_book, VaultCredentialRecord,
-    VaultItemStatus, VaultLoginPlaybook, VaultLoginSession,
+    resolve_login_session, resolve_record_secret_field, resolve_secret_with_cipher_book,
+    VaultCredentialRecord, VaultItemStatus, VaultLoginPlaybook, VaultLoginSession,
 };
 use crate::token::DEFAULT_ACTOR;
 use serde_json::{json, Value};
@@ -376,6 +376,7 @@ pub fn put_ai_vault_session(
         expires_at: Some(expires.clone()),
         last_login_at: Some(now),
         source: Some(source.trim().to_string()),
+        ..Default::default()
     };
     let record = put_login_session(&root, credential_id, session)?;
     let _ = append_vault_audit(
@@ -432,8 +433,11 @@ pub fn login_ai_vault_credential(
         )
     });
 
+    // Prefer per-account session files (12-3); frontmatter is fallback inside resolve.
+    let resolved_session = resolve_login_session(&root, &record, None).ok().flatten();
+
     if playbook.is_human_required() && !force_refresh {
-        if let Some(sess) = record.login_session.as_ref() {
+        if let Some(sess) = resolved_session.as_ref() {
             if login_session_is_fresh(sess) {
                 let cookie = sess.cookie_header.clone().unwrap_or_default();
                 let _ = append_vault_audit(
@@ -452,6 +456,7 @@ pub fn login_ai_vault_credential(
                     "mode": "session",
                     "cookieHeader": cookie,
                     "expiresAt": sess.expires_at,
+                    "accountId": sess.account_id,
                     "loginPlaybook": playbook,
                     "transcriptHint": "已复用登录态",
                     "note": "playbook=human_required；有可用 session 直接复用",
@@ -479,7 +484,7 @@ pub fn login_ai_vault_credential(
     }
 
     if !force_refresh {
-        if let Some(sess) = record.login_session.as_ref() {
+        if let Some(sess) = resolved_session.as_ref() {
             if login_session_is_fresh(sess) {
                 let cookie = sess.cookie_header.clone().unwrap_or_default();
                 let _ = append_vault_audit(
@@ -499,6 +504,7 @@ pub fn login_ai_vault_credential(
                     "cookieHeader": cookie,
                     "expiresAt": sess.expires_at,
                     "source": sess.source,
+                    "accountId": sess.account_id,
                     "loginPlaybook": {
                         "mode": playbook.mode,
                         "preferredAccount": playbook.preferred_account,
@@ -736,6 +742,7 @@ pub fn login_ai_vault_credential(
         expires_at: Some(expires.clone()),
         last_login_at: Some(now),
         source: Some("api".into()),
+        ..Default::default()
     };
     let _ = put_login_session(&root, credential_id, session)?;
     let _ = append_vault_audit(