feat: encrypted vault export & import (CSV)

[GabrielBBaldez]

What

Adds vault export and import (#81): POST /api/vault/export and POST /api/vault/import.

Behaviour

• Encrypted by default — export is a password-protected envelope (AES-GCM, PBKDF2 key derived from a separate export password); a plaintext CSV is only produced when explicitly confirmed.
• Import auto-detects the encrypted envelope vs. a plaintext CSV.
• Interoperable — the CSV uses a standard name,username,password,url,notes,category layout, and import maps common headers from other managers (Bitwarden login_username/login_uri/folder, KeePass Title/Group, …) so a vault can be brought in without hand-editing.
• Categories are recreated by name on import.
• Passwords are stored through the existing vault encryption path. The export password is independent of the master password, so an export stays portable across instances.

Acceptance criteria

• User can export their vault to a standard format (CSV)
• User can import entries from that format
• Encrypted export is the default; plaintext export needs explicit confirmation
• Imported entries land in the right categories where possible

Notes

• .kdbx is intentionally left for a follow-up — the issue lists CSV as an acceptable fallback, and a binary KeePass format is better handled separately.
• The encrypted envelope is VWENC1: + base64(iterations | salt | iv | ciphertext); a wrong export password is reported distinctly from a corrupt file.

Tests

Unit tests cover the CSV round-trip (commas, quotes, embedded newlines), the password-based encrypt/decrypt (round-trip, wrong password, malformed envelope), and the full export → import round-trip including category creation and interop headers. The new request DTOs are added to the existing toString secrecy test so the export/import passwords never leak into logs.

Closes #81

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[DenizAltunkapan]

@GabrielBBaldez very good work