fix(setup): seal wizard secrets into the vault the bot opens (#156)

[chinkan]

Fixes #156 (P0).

Problem

The setup wizard sealed credentials into <config_dir>/secrets/vault, but the bot opens <resolved home>/secrets/vault (RUSTFOX_HOME, then [general].home, then ~/.rustfox). Running rustfox --setup from any folder other than ~/.rustfox therefore produced a bot that exits with secret 'openrouter.api_key' not found in SecretStore.

Fix

• home::home_for_config_text resolves the home from the config text with the same precedence as Config::resolve. The web wizard save, the CLI wizard save and /api/add-bot all seal into that home, so the vault no longer depends on the working directory.
• secret_store::import_config_dir_vault runs on boot before the store opens. If an older wizard left a vault beside config.toml (and that folder is not the home), its secrets are copied into the home vault. Names already in the home vault win, values are read back after write, and the old vault is left in place. It copies file to file so a stale keyutils entry cannot shadow the newer wizard value. Existing users do not need to run setup again.
• The wizard done page now says rustfox instead of cargo run --bin rustfox.

macOS and Windows use the OS keyring, which does not depend on a path, so this only changes behaviour when the encrypted file vault is used (always on Linux).

Acceptance criteria

1. Wizard write and bot read use one vault path regardless of where config.toml lives.
2. A fresh --setup from any folder boots with no SecretStore error.
3. An existing vault beside config.toml is read without re-running setup, with no silent secret loss.

Tests

• wizard_seal_writes_the_vault_the_bot_opens: the seal lands in <home>/secrets/vault and the written config resolves to the same home.
• config_dir_vault_secrets_are_copied_without_overwriting: old secrets are copied, the home value wins, the old vault is kept, and a second run copies nothing.
• config_dir_vault_import_is_a_no_op_for_home_or_missing_vault: no copy when the config folder is the home, and no stray key file when there is no old vault.
• config_text_home_reads_general_home.

cargo fmt --check, cargo clippy --all-targets -- -D warnings and cargo test --locked pass (921 tests).

Manual check on Linux with an empty HOME, running from ~/Downloads/rustfox:

• rustfox --setup --cli writes ~/.rustfox/secrets/vault, and nothing is written beside config.toml.
• rustfox gets past secret resolution and starts the Telegram dispatcher. It then stops only because the test token is fake.
• After moving the vault beside config.toml to simulate an old install, boot logs Copied 2 secret(s) from the vault beside config.toml and starts. The next boot copies nothing.

[chinkan]

TL ACCEPT at 6267a19.

Matches #156 AC:

1. Wizard seal (web/CLI/add-bot) uses home_for_config_text with the same precedence as the bot — vault no longer follows cwd.
2. Fresh setup from a non-home folder lands secrets where boot opens them.
3. Boot-time import_config_dir_vault copies missing names from a legacy beside-config vault; home wins; old vault kept; idempotent. Regression tests cover the main paths.

Done-page hint rustfox is fine.

Non-blocking polish (Researcher edge): when both vaults have the same name but different values, log a warn naming which value is kept (home) and which is skipped (config-dir). No behaviour change. Nice if it lands in this tip before merge; otherwise a tiny follow-up is OK — do not HOLD #157 for it.

Merge after CI green + Product GO + QA three-AC smoke (incl. real TG reply). Do not tag until #156 is fixed (this PR).