refactor: rename alknet-secret to alknet-vault

Rename the crate from alknet-secret to alknet-vault to better reflect its
purpose as a local key vault (seed management, key derivation, encryption)
rather than a network service.

Symbol renames:
- SecretService → VaultService
- SecretServiceHandle → VaultServiceHandle
- SecretServiceActor → VaultServiceActor
- SecretServiceError → VaultServiceError
- SecretProtocol → VaultProtocol
- SecretMessage → VaultMessage
- ServiceLocked → VaultLocked
- alknet_secret → alknet_vault (crate name)

Update ADR-008 with vault access pattern: the vault is a capability source,
not a service endpoint. The CLI injects derived/decrypted material into
operation contexts — handlers never hold vault references.

crates/alknet-vault/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "alknet-vault"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Local key vault: BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption for securing provider keys, credentials, and identity material"
+repository.workspace = true
+
+[lib]
+name = "alknet_vault"
+
+[features]
+default = []
+secp256k1 = ["dep:secp256k1"]
+
+[dependencies]
+bip39 = { version = "2", features = ["rand"] }
+ed25519-bip32 = "0.4"
+aes-gcm = "0.10"
+sha2 = "0.10"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+zeroize = { version = "1", features = ["derive"] }
+hmac = "0.12"
+rand = "0.8"
+base64 = "0.22"
+irpc = { workspace = true }
+irpc-derive = { workspace = true }
+tokio = { version = "1", features = ["sync", "rt", "macros"] }
+secp256k1 = { version = "0.29", optional = true }
+
+[dev-dependencies]
+hex = "0.4"
+postcard = { version = "1", features = ["alloc"] }