feat(#353): Create VaultService NestJS module for OpenBao Transit

Implements secure credential encryption using OpenBao Transit API with
automatic fallback to AES-256-GCM when OpenBao is unavailable.

Features:
- AppRole authentication with automatic token renewal at 50% TTL
- Transit encrypt/decrypt with 4 named keys
- Automatic fallback to CryptoService when OpenBao unavailable
- Auto-detection of ciphertext format (vault:v1: vs AES)
- Request timeout protection (5s default)
- Health indicator for monitoring
- Backward compatible with existing AES-encrypted data

Security:
- ERROR-level logging for fallback
- Proper error propagation (no silent failures)
- Request timeouts prevent hung operations
- Secure credential file reading

Migrations:
- Account encryption middleware uses VaultService
- Uses TransitKey.ACCOUNT_TOKENS for OAuth tokens
- Backward compatible with existing encrypted data

Tests: 56 tests passing (36 VaultService + 20 middleware)

Closes #353

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/prisma/prisma.module.ts

@@ -1,18 +1,19 @@
 import { Global, Module } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
 import { PrismaService } from "./prisma.service";
-import { CryptoService } from "../federation/crypto.service";
+import { VaultModule } from "../vault/vault.module";
 
 /**
  * Global Prisma module providing database access throughout the application
  * Marked as @Global() so PrismaService is available in all modules without importing
  *
- * Includes CryptoService for transparent Account token encryption (Issue #352)
+ * Includes VaultModule for transparent Account token encryption via OpenBao Transit
+ * with AES-256-GCM fallback (Issue #353)
  */
 @Global()
 @Module({
-  imports: [ConfigModule],
-  providers: [PrismaService, CryptoService],
+  imports: [ConfigModule, VaultModule],
+  providers: [PrismaService],
   exports: [PrismaService],
 })
 export class PrismaModule {}