feat(auth): durable vault-unlock secret to stop repeated password prompts (Phase 1)

[LiranCohen]

Phase 1 of the auth/session/server redesign (#186). Stacked on #185 (fix/install-wrapper-symlink-clobber), which contains the session/helper subsystem being reworked.

What & why

gitd asked for the vault password on essentially every command because each one unlocked its own agent via an ad-hoc getPassword() (env → TTY prompt) with no durable cache. This PR introduces a single resolution path and a durable per-profile secret store, so after the first unlock the session is restored without re-prompting — the first concrete fix for "asked for the vault password repeatedly" and a session that survives across separate processes.

Changes

• src/auth/secret-store.ts — durable per-profile secret store: OS keychain (macOS security, Linux secret-tool) when available, otherwise a machine-keyed AES-256-GCM encrypted file under ~/.enbox/secrets/ (mode 0600). GITD_SECRET_BACKEND=keychain|file|none pins/disables the backend.
• src/auth/vault-password.ts — one resolution path: explicit → GITD_PASSWORD → hidden public-reader secret → durable store → interactive prompt (TTY raw / piped), tracking the source. rememberVaultSecret caches only freshly entered (tty/explicit) secrets — never env. forgetVaultSecret clears them.
• src/cli/main.ts — both connect sites resolve via the new path and cache on a verified unlock; a rejected cached secret is cleared automatically so a stale secret can't lock you out. (Removes the old inline getPassword.)
• src/cli/commands/auth.ts — auth login caches the new secret; auth logout / auth reset drop it.
• src/cli/identity-wizard.ts — first-run wizard caches the secret too.

Behavior / compatibility

• GITD_PASSWORD still wins for CI/non-interactive use and is not persisted.
• The public-reader (no-identity) path is unchanged.
• No daemon, credential-helper, or wallet changes in this PR (later phases).

Verification

• bun run build — clean (zero TS errors)
• bun run lint — clean (--max-warnings 0)
• bun test .spec.ts — 1802 pass, 8 skip, 0 fail (incl. 17 new tests in tests/secret-store.spec.ts and tests/vault-password.spec.ts covering round-trip, encryption-at-rest, resolution precedence, cache-only-fresh-secrets, and forget)

🤖 Generated with Claude Code