Add cp, folder mv, get -r, and unlock/lock to remember the key

Filesystem basics: mv now moves folders as well as files, and like mv(1)
a NEW ending in / or naming an existing folder means into it. cp copies a
file, or a folder with -r, by writing new records that share the
original's objects, so it is instant and takes no space; rm already keeps
objects another record still uses. New records go first, so an
interrupted move leaves both names, never neither. get -r extracts a
folder, keeping its structure.

vault unlock [--for 5m] checks the passphrase and starts the binary again
as a hidden __agent process, handing it the suite ID and seed over a pipe.
The agent keeps them in mlocked memory, with core dumps off and (on Linux)
PR_SET_DUMPABLE cleared, serves them on a Unix socket in a 0700 per-user
directory whose owner is checked on every use, and wipes them and exits
at a hard deadline or on vault lock. Commands ask it first unless
VAULT_PASSPHRASE is set, and genkey stops any agent left for that path.

Guide, man pages (new vault-cp, vault-unlock, vault-lock), README and
screenshots updated; the guide's error table is split so it fits.

docs/vault-mv.1

@@ -1,6 +1,6 @@
 .TH VAULT-MV 1 "September 2026" "vault" "User Commands"
 .SH NAME
-vault-mv \- rename a stored file
+vault-mv \- rename or move a stored file or folder
 .SH SYNOPSIS
 .B vault mv
 .RB [ \-\-key
@@ -12,9 +12,12 @@ vault-mv \- rename a stored file
 .B vault rename
 \&...
 .SH DESCRIPTION
-Renames \fIOLD\fR to \fINEW\fR, which may be in another folder. Fails if
-\fINEW\fR exists or is not a valid vault path. File contents are not
-re-encrypted.
+Renames \fIOLD\fR, a file or a folder and everything under it, to
+\fINEW\fR. If \fINEW\fR ends in / or names an existing folder, \fIOLD\fR
+moves into it, keeping its base name, as with
+.BR mv (1).
+Fails, changing nothing, if any new name exists or is not a valid vault
+path. File contents are not re-encrypted.
 .SH OPTIONS
 .TP
 .BI \-\-key " PATH"
@@ -28,6 +31,7 @@ Vault directory. Default: $VAULT_DIR, else ~/.vault/store.
 Passphrase, instead of prompting on the terminal.
 .SH SEE ALSO
 .BR vault (1),
+.BR vault\-cp (1),
 .BR vault\-rm (1)
 .SH AUTHOR
 Andy Dixon <vault@dixon.cx>, https://www.dixon.cx