GH #253 — Vaultwarden to Paperclip secret sync

[ssdavidai]

Summary

Implements one-way Vaultwarden → Paperclip secret sync for GH #253.

• Vaultwarden remains authoritative; Paperclip local_encrypted secrets are read-replica copies.
• Adds a company-scoped ctrl route for selected Vaultwarden folder items.
• Supports dry-run, create/rotate/no-op actions, and explicitly rejects prune=true so deletion is separately gated.
• Avoids returning secret values in API responses.
• Adds operator documentation and manual sync script.

Smoke evidence

• npm ci
• node --experimental-sqlite --experimental-test-module-mocks --import tsx --experimental-loader ./tests/text-loader.mjs --test tests/paperclip_admin.test.ts — 18/18 passing
• npm run build — Build complete — dist/api.mjs

Paperclip: ALFA-57