Add cp, folder mv, get -r, and unlock/lock to remember the key

Filesystem basics: mv now moves folders as well as files, and like mv(1)
a NEW ending in / or naming an existing folder means into it. cp copies a
file, or a folder with -r, by writing new records that share the
original's objects, so it is instant and takes no space; rm already keeps
objects another record still uses. New records go first, so an
interrupted move leaves both names, never neither. get -r extracts a
folder, keeping its structure.

vault unlock [--for 5m] checks the passphrase and starts the binary again
as a hidden __agent process, handing it the suite ID and seed over a pipe.
The agent keeps them in mlocked memory, with core dumps off and (on Linux)
PR_SET_DUMPABLE cleared, serves them on a Unix socket in a 0700 per-user
directory whose owner is checked on every use, and wipes them and exits
at a hard deadline or on vault lock. Commands ask it first unless
VAULT_PASSPHRASE is set, and genkey stops any agent left for that path.

Guide, man pages (new vault-cp, vault-unlock, vault-lock), README and
screenshots updated; the guide's error table is split so it fits.

docs/vault-get.1

@@ -3,6 +3,7 @@
 vault-get \- decrypt a stored file
 .SH SYNOPSIS
 .B vault get
+.RB [ \-r ]
 .RB [ \-o
 .IR OUTPUT ]
 .RB [ \-\-key
@@ -14,10 +15,19 @@ vault-get \- decrypt a stored file
 Decrypts \fINAME\fR. Nothing appears at the output path until every object has
 authenticated. The stored mode and modification time are restored. It refuses
 to overwrite an existing file. Takes a shared lock.
+.PP
+With \fB\-r\fR, \fINAME\fR is a folder, and every file under it is
+decrypted into the output directory, keeping the folder structure. Each file
+is checked as above; a clash stops the run, leaving the files already
+written.
 .SH OPTIONS
 .TP
 .BI \-o " OUTPUT"
-Output path. Default: the base name of \fINAME\fR in the current directory.
+Output path, or with \fB\-r\fR output directory. Default: the base name of
+\fINAME\fR in the current directory.
+.TP
+.B \-r
+Decrypt a folder and everything under it.
 .PP
 See also \fB\-\-key\fR and \fB\-\-vault\fR in
 .BR vault (1).