feat: vault core/CLI/workbench, vaultd token path, filetree view-state cleanup

Land password-vault dedicated workbench and mnote-vault-core/CLI, agent token
read path design, vault transport split, and retire obsolete filetree smokes.
Ignore local vault reimport scripts that trip secret scanners.

scripts/mnote-vault-cli.js

@@ -13,6 +13,7 @@
  *   node scripts/mnote-vault-cli.js list
  *   node scripts/mnote-vault-cli.js get --id cred_xxx
  *   node scripts/mnote-vault-cli.js resolve --id cred_xxx --field password
+ *   node scripts/mnote-vault-cli.js resolve --id cred_xxx --field password --account-id acc_xxx
  *
  * Never print secrets to logs other than resolve stdout value line when --raw.
  * Default resolve prints JSON including value for tool piping; use --raw for plain value only.
@@ -29,7 +30,8 @@ function usage() {
   mnote-vault-cli.js auth-e2e   # print export MNOTE_COOKIE=... for local mnote-web
   mnote-vault-cli.js list [--status active|deleted]
   mnote-vault-cli.js get --id <credentialId>
-  mnote-vault-cli.js resolve --id <credentialId> --field password|apikey|token [--raw]
+  mnote-vault-cli.js resolve --id <credentialId> --field password|apikey|token|username|email \\
+      [--account-id <accountId>] [--secret-id <secretId>] [--raw]
   mnote-vault-cli.js login --id <credentialId> [--force]
   mnote-vault-cli.js session --id <credentialId> --cookie <CookieHeader> [--source human_bridge]
 
@@ -37,6 +39,7 @@ Env: MNOTE_BASE_URL, MNOTE_COOKIE
   auth-e2e uses MNOTE_E2E_EMAIL / MNOTE_E2E_PASSWORD (defaults: mnote.e2e@example.com / MnoteE2E123!)
 
 Steady-state: auth-e2e once → list (optional) → login (reuse session).
+Multi-account: get item → pick accounts[].id → resolve --account-id …
 Human Cloudflare: browser then "session" write-back.`);
   process.exit(2);
 }
@@ -51,7 +54,9 @@ function parseArgs(argv) {
       a === '--status' ||
       a === '--cookie' ||
       a === '--source' ||
-      a === '--expires'
+      a === '--expires' ||
+      a === '--account-id' ||
+      a === '--secret-id'
     ) {
       out[a.slice(2)] = argv[++i];
     } else if (a === '--raw' || a === '--force') {
@@ -173,10 +178,13 @@ async function main() {
   }
   if (cmd === 'resolve') {
     if (!args.id || !args.field) usage();
+    const body = { field: args.field };
+    if (args['account-id']) body.accountId = args['account-id'];
+    if (args['secret-id']) body.secretId = args['secret-id'];
     const result = await api(
       'POST',
       `/api/vault/ai/items/${encodeURIComponent(args.id)}/resolve`,
-      { field: args.field }
+      body
     );
     if (args.raw) {
       if (result && result.resolved && result.value != null) {