Fix path traversal in /vault/{path} handlers (GHSA-62gx-5q78-wrvx)

GET, PUT, POST, PATCH, DELETE, and MOVE on /vault/{path} all decoded the
request path with decodeURIComponent after Express routing. A literal "../"
is normalised away by the router (→ 404), but "..%2F" is not a path separator
at routing time, so it survived to the handler where decodeURIComponent turned
it into a real slash — reconstituting a traversal that escaped the vault root.

The fix adds a private extractVaultPath helper that decodes the path and then
applies the same posix.resolve + startsWith("/vault/") confinement check that
_vaultMove already used for its Destination header. Any path that resolves
outside the synthetic "/vault" root is rejected with HTTP 400 / errorCode
40021 (PathTraversalNotAllowed). All six vault-route public methods now obtain
their decoded path through this helper rather than calling decodeURIComponent
directly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>