Add cp, folder mv, get -r, and unlock/lock to remember the key

Filesystem basics: mv now moves folders as well as files, and like mv(1)
a NEW ending in / or naming an existing folder means into it. cp copies a
file, or a folder with -r, by writing new records that share the
original's objects, so it is instant and takes no space; rm already keeps
objects another record still uses. New records go first, so an
interrupted move leaves both names, never neither. get -r extracts a
folder, keeping its structure.

vault unlock [--for 5m] checks the passphrase and starts the binary again
as a hidden __agent process, handing it the suite ID and seed over a pipe.
The agent keeps them in mlocked memory, with core dumps off and (on Linux)
PR_SET_DUMPABLE cleared, serves them on a Unix socket in a 0700 per-user
directory whose owner is checked on every use, and wipes them and exits
at a hard deadline or on vault lock. Commands ask it first unless
VAULT_PASSPHRASE is set, and genkey stops any agent left for that path.

Guide, man pages (new vault-cp, vault-unlock, vault-lock), README and
screenshots updated; the guide's error table is split so it fits.

docs/vault.1

@@ -43,18 +43,30 @@ lists one folder, with sub-folders marked;
 lists every file under a folder.
 .TP
 .BR vault\-get (1)
-Decrypt a stored file.
+Decrypt a stored file, or a whole folder with
+.BR \-r .
 .TP
 .BR vault\-mv (1)
-Rename a stored file (alias:
+Rename or move a stored file or folder (alias:
 .BR rename ).
 .TP
+.BR vault\-cp (1)
+Copy a stored file, or a whole folder with
+.BR \-r .
+.TP
 .BR vault\-rm (1)
 Delete a stored file, or a whole folder with
 .B \-r
 (alias:
 .BR delete ).
 .TP
+.BR vault\-unlock (1)
+Remember the unlocked key for a while (default 5 minutes), so commands
+skip the passphrase.
+.TP
+.BR vault\-lock (1)
+Forget it now.
+.TP
 .B help
 Print usage.
 .SH OPTIONS
@@ -74,7 +86,8 @@ Default key file.
 Default vault directory.
 .TP
 .B VAULT_PASSPHRASE
-Passphrase, instead of prompting on the terminal.
+Passphrase, instead of prompting on the terminal or using a key remembered by
+.BR vault\-unlock (1).
 .TP
 .B VAULT_DECOY_PASSPHRASE
 Decoy passphrase used by