feat: vault core/CLI/workbench, vaultd token path, filetree view-state cleanup

Land password-vault dedicated workbench and mnote-vault-core/CLI, agent token
read path design, vault transport split, and retire obsolete filetree smokes.
Ignore local vault reimport scripts that trip secret scanners.

rust/crates/mnote-web/src/routes/gateway.rs

@@ -1419,6 +1419,12 @@ fn render_vault_workbench_html(workspace_id: &str, root_uri: &str, bootstrap: &V
     <div class="mnote-vault-header-actions">
       <button type="button" data-vault-create data-testid="vault-create">新建</button>
       <button type="button" data-vault-cipher-book data-testid="vault-cipher-book">密文簿</button>
+      <label class="mnote-vault-insert-cipher" title="在当前焦点字段光标处插入 [Key]" hidden aria-hidden="true">
+        <span class="mnote-vault-sr-only">插入密文</span>
+        <select data-vault-insert-cipher data-testid="vault-insert-cipher" aria-label="插入密文">
+          <option value="">插入密文…</option>
+        </select>
+      </label>
       <input type="search" data-vault-search data-testid="vault-search" placeholder="搜索标题、用户名、标签、分组…" aria-label="搜索密码条目" />
       <div class="mnote-vault-tabs" role="tablist">
         <button type="button" role="tab" data-vault-tab="active" class="is-active" aria-selected="true">在用</button>