Initial vault: single-binary post-quantum file vault

Strip Fury back to its vault functionality in one `vault` command:
genkey, init, add (file or directory, optional folder inside the vault),
list, get, mv and rm.

The hybrid FrodoKEM-640 + ML-KEM-768 encryption core is kept under
internal/pqcrypt. Signing, policies, profiles, backups, SSH remotes,
FIDO2, agents, provenance and compression are removed.

internal/term/term_windows.go

@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package term
+
+import (
+	"errors"
+	"os"
+	"syscall"
+
+	"golang.org/x/sys/windows"
+)
+
+func init() {
+	enableVirtualTerminalProcessing = func(out *os.File) error {
+		// Some instances of the Windows Console (e.g., cmd.exe and Windows PowerShell)
+		// do not have the virtual terminal processing enabled, which is necessary to
+		// make terminal escape sequences work. For this reason the clearLine function
+		// may not properly work. Here we enable the virtual terminal processing, if
+		// possible.
+		//
+		// See https://learn.microsoft.com/en-us/windows/console/console-virtual-terminal-sequences.
+
+		const (
+			ENABLE_PROCESSED_OUTPUT            uint32 = 0x1
+			ENABLE_VIRTUAL_TERMINAL_PROCESSING uint32 = 0x4
+		)
+
+		kernel32DLL := windows.NewLazySystemDLL("Kernel32.dll")
+		setConsoleMode := kernel32DLL.NewProc("SetConsoleMode")
+
+		var mode uint32
+		if err := syscall.GetConsoleMode(syscall.Handle(out.Fd()), &mode); err != nil {
+			return err
+		}
+
+		mode |= ENABLE_PROCESSED_OUTPUT
+		mode |= ENABLE_VIRTUAL_TERMINAL_PROCESSING
+
+		// If the SetConsoleMode function fails, the return value is zero.
+		// See https://learn.microsoft.com/en-us/windows/console/setconsolemode#return-value.
+		if ret, _, _ := setConsoleMode.Call(out.Fd(), uintptr(mode)); ret == 0 {
+			return errors.New("SetConsoleMode failed")
+		}
+		return nil
+	}
+}