Restore --vault, --vault-key, --vault-path CLI flags after clap migration

[bug-ops]

Problem

When CLI argument parsing was migrated from manual std::env::args() to clap::Parser, the vault-related flags (--vault, --vault-key, --vault-path) were not added to the Cli struct. Clap rejects unknown arguments, so these flags cause an error before parse_vault_args() in bootstrap.rs can process them.

Additionally, --config and --tui were being parsed both by clap and manually via std::env::args(), creating redundant parsing.

Fix

• Added --vault, --vault-key, --vault-path fields to Cli struct
• Refactored AppBuilder::from_env() -> AppBuilder::new() to accept explicit CLI overrides
• Refactored parse_vault_args() to accept CLI overrides instead of parsing std::env::args() manually
• Added ZEPH_VAULT_KEY and ZEPH_VAULT_PATH env var support for key/path
• Refactored resolve_config_path() to accept CLI override
• Removed is_tui_requested() in favor of clap-parsed cli.tui
• Added regression tests for CLI vault flag parsing and priority chain

Priority chain (preserved)

--vault CLI flag > ZEPH_VAULT_BACKEND env > config.vault.backend > "env" default