feat(v3): migrate workspace to API, Tauri desktop, and v3 crates; remove legacy MCP stack

- Add apps/api, desktop Tauri shell, domain/application/crypto/device-auth/infrastructure-db
- Replace desktop-daemon vault integration; drop secrets-core and secrets-mcp*
- Ignore apps/desktop/dist and generated Tauri icons; document icon/dist steps in AGENTS.md
- Apply rustfmt; fix clippy (collapsible_if, HTTP method as str)

crates/domain/src/vault_object.rs

@@ -0,0 +1,48 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum VaultObjectKind {
+    Cipher,
+}
+
+impl VaultObjectKind {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Cipher => "cipher",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct VaultObjectEnvelope {
+    pub object_id: Uuid,
+    pub object_kind: VaultObjectKind,
+    pub revision: i64,
+    pub cipher_version: i32,
+    pub ciphertext: Vec<u8>,
+    pub content_hash: String,
+    pub deleted_at: Option<DateTime<Utc>>,
+    pub updated_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct VaultObjectChange {
+    pub change_id: Uuid,
+    pub object_id: Uuid,
+    pub object_kind: VaultObjectKind,
+    pub operation: String,
+    pub base_revision: Option<i64>,
+    pub cipher_version: Option<i32>,
+    pub ciphertext: Option<Vec<u8>>,
+    pub content_hash: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub struct VaultTombstone {
+    pub object_id: Uuid,
+    pub revision: i64,
+    pub deleted_at: DateTime<Utc>,
+}