chore: untrack vault.db (contains user secrets)

vault.db was tracked from the start of the repo, meaning every commit
since the initial import has captured snapshots of the user's password
data. Even though entries are AES-GCM encrypted in the DB, the file
also contains:
  - PBKDF2 salt + hash of the master password (offline-crackable)
  - Audit log with timestamps + IP addresses
  - Session tokens (transient but historical)
  - Login attempt counters per username

Future commits no longer include vault.db. The Delphi/PHP backend
auto-creates the schema via CREATE TABLE IF NOT EXISTS on first run,
so a fresh clone needs no migration step.

Also ignore the SQLite sidecar files (-journal, -wal, -shm).

NOTE: this only stops future leaks. The historical commits still
contain old snapshots. Purging history requires git filter-repo +
force-push, which rewrites every commit hash and breaks existing
clones. See README for instructions if a history purge is desired.

.gitignore

@@ -1,6 +1,14 @@
 
 vault-error.log
 
+# Vault database — contains user secrets (encrypted but still secret).
+# Auto-created on first run by the Delphi/PHP backend via InitDatabase().
+# Never track this file. Use vault.db.example for schema reference if needed.
+vault.db
+vault.db-journal
+vault.db-wal
+vault.db-shm
+
 # Delphi build artifacts
 *.dcu
 *.dcp