Port alknet-vault crate from alknet

Copy the local key vault (src/, tests/) verbatim from
alknet/crates/alknet-vault and create a standalone Cargo.toml
(workspace-inherited fields inlined). Port the architecture docs
(specs, ADRs 018-026, OQs 020-022) from alknet's nested multi-crate
layout to a flat single-crate layout, fixing relative link paths.

ADR and OQ numbers are preserved from alknet; a subsequent pass will
renumber them to a per-project sequence (001, 002, ...) and rebrand
alknet-vault -> alkvault (crate name, lib name, prose), updating the
cross-references to non-vault alknet ADRs (003, 005, 008, 010, 014,
064) that are referenced in the copied docs but not copied over.

Build, 108 tests, and clippy all pass clean.

Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "alknet-vault"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Local key vault: BIP39 mnemonic generation, SLIP-0010 Ed25519 HD key derivation, AES-256-GCM encryption for securing provider keys, credentials, and identity material"
+repository = "https://git.alk.dev/alkdev/alkvault"
+
+[lib]
+name = "alknet_vault"
+
+[features]
+default = []
+secp256k1 = ["dep:secp256k1"]
+
+[dependencies]
+bip39 = { version = "2", features = ["rand", "zeroize"] }
+ed25519-bip32 = "0.4"
+aes-gcm = "0.10"
+sha2 = "0.10"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+zeroize = { version = "1", features = ["derive"] }
+hmac = "0.12"
+rand = "0.8"
+base64 = "0.22"
+secp256k1 = { version = "0.29", optional = true }
+
+[dev-dependencies]
+hex = "0.4"