feat: add Vaultwarden password manager stack

Added self-hosted password manager to The Falcon infrastructure:

**Vault Stack** (vault.pivoine.art):
- Vaultwarden (Bitwarden-compatible server)
- SQLite database for password storage
- WebSocket support for real-time sync
- TOTP and WebAuthn/U2F 2FA support
- Browser extensions and mobile apps compatible

**Configuration:**
- Domain: https://vault.pivoine.art
- Signups: Disabled (invite-only for security)
- Invitations: Enabled
- Password hints: Disabled (security best practice)
- First user becomes admin

**Backup Integration:**
- Added vaultwarden-backup plan to Restic
- Schedule: 8 AM daily (same as letsencrypt)
- Retention: 7 daily, 4 weekly, 12 monthly, 3 yearly
- Backup volume: vault_data mounted read-only

**Infrastructure Updates:**
- Created vault/compose.yaml following stack pattern
- Added VAULT_* environment variables to arty.yml
- Updated compose.yaml to include vault stack
- Added backup_vaultwarden_data volume to restic
- Updated restic/config.json with 12th backup plan

**Documentation:**
- Added Vault to CORE SYSTEMS in README
- Added to ship architecture diagram
- Documented in CLAUDE.md with configuration details
- Updated volume management sections
- Backup count increased from 11 to 12 plans

Critical data backed up with long retention (3 years yearly).
Compatible with official Bitwarden clients on all platforms.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -20,6 +20,7 @@ Root `compose.yaml` uses Docker Compose's `include` directive to orchestrate mul
 - **n8n**: Workflow automation platform (PostgreSQL)
 - **stash**: Filestash web-based file manager
 - **links**: Linkwarden bookmark manager (PostgreSQL + Meilisearch)
+- **vault**: Vaultwarden password manager (SQLite)
 - **restic**: Backrest backup system with restic backend
 - **sablier**: Dynamic scaling plugin for Traefik
 - **vpn**: WireGuard VPN (wg-easy)
@@ -197,6 +198,29 @@ Linkwarden bookmark manager with full-text search:
 - `LINKS_NEXTAUTH_SECRET`: NextAuth.js secret for session encryption
 - `LINKS_MEILI_MASTER_KEY`: Meilisearch master key for API authentication
 
+### Vault (vault/compose.yaml)
+Vaultwarden password manager (Bitwarden-compatible server):
+- **vaultwarden**: Vaultwarden app exposed at `vault.pivoine.art:80`
+  - Self-hosted password manager compatible with Bitwarden clients
+  - Supports TOTP, WebAuthn/U2F two-factor authentication
+  - Secure password generation and sharing
+  - Browser extensions and mobile apps available
+  - Emergency access and organization support
+  - Data persisted in `vaultwarden_data` volume (SQLite database)
+
+**Configuration**:
+- **DOMAIN**: `https://vault.pivoine.art` (required for proper HTTPS operation)
+- **WEBSOCKET_ENABLED**: `true` (enables real-time sync)
+- **SIGNUPS_ALLOWED**: `false` (disable open registrations for security)
+- **INVITATIONS_ALLOWED**: `true` (allow inviting users)
+- **SHOW_PASSWORD_HINT**: `false` (security best practice)
+
+**Important**:
+- First user to register becomes the admin
+- Use strong master password - it cannot be recovered
+- Enable 2FA for all accounts
+- Access admin panel at `/admin` (requires `ADMIN_TOKEN` in `.env`)
+
 ### Restic (restic/compose.yaml)
 Backrest backup system with restic backend:
 - **backrest**: Backrest web UI exposed at `restic.pivoine.art:9898`
@@ -262,6 +286,10 @@ Backrest backup system with restic backend:
     - Path: `/volumes/letsencrypt_data`
     - Retention: 7 daily, 4 weekly, 12 monthly, 3 yearly
 
+12. **vaultwarden-backup** (8 AM daily)
+    - Path: `/volumes/vaultwarden_data`
+    - Retention: 7 daily, 4 weekly, 12 monthly, 3 yearly
+
 **Volume Mounting**:
 All Docker volumes are mounted read-only to `/volumes/` with prefixed names (e.g., `backup_core_postgres_data`) to avoid naming conflicts with other compose stacks.
 
@@ -296,6 +324,7 @@ Each service uses named volumes prefixed with project name:
 - `n8n_n8n_data`: n8n workflow data
 - `stash_filestash_data`: Filestash configuration and state
 - `links_data`, `links_meili_data`: Linkwarden bookmarks and Meilisearch index
+- `vault_data`: Vaultwarden password vault (SQLite database)
 - `restic_data`, `restic_config`, `restic_cache`, `restic_tmp`: Backrest backup system
 - `proxy_letsencrypt_data`: SSL certificates