feat: organization-key (Collections) support + TUI reveal from any pane

[UnbreakableMJ]

Two fixes from daily-driving Vault against a Bitwarden-cloud account whose vault is ~99% organization/Collection-owned (2262 of 2274 items).

Organization-key support (the headline)

Vault decrypted only personal ciphers (and per-cipher keys under the user key); organization items were skipped — their fields are encrypted under an org key Vault didn't hold. Now, at unlock, the agent:

1. recovers the account RSA private key from /sync profile.privateKey (a type-2 EncString under the user key);
2. RSA-OAEP-SHA1-unwraps each profile.organizations[].key (type-4 EncString) into that org's symmetric key;
3. routes every cipher's decryption by organization_id — org key vs user key — via Vault::base_keys.

Works online and from the offline cache (the cached /sync carries the profile). New vault_core::org_key module and a new rsa dependency (ring has no RSA decryption), with a justified RUSTSEC-2023-0071 ignore in deny.toml + CI (the Marvin timing attack needs a network decryption oracle; Vault unwraps org keys once, locally, at unlock).

Scope: items whose org key can't be unwrapped are still skipped (logged); editing org items is refused for now — the write path would re-encrypt under the wrong key (reads/copy work). Org-aware writes are a follow-up.

TUI Space reveals from any pane

Space revealed a login's password from the item list but did nothing in the detail pane (logins have no per-field rows) or the folder pane. Resolution moved into a testable App::reveal_target: cards/identities reveal the cursor-selected masked field in the detail pane; logins/notes fall back to the primary secret; the list and folder panes reveal the selected item's primary secret — so Space works from all three panes.

Verification

Full just ci green (fmt, clippy -D warnings, test, deny, audit, reuse). New tests: RSA OAEP round-trip, org-cipher decrypt + edit-refusal, reveal_target across panes/types. Live-verified against the real cloud vault: login (password + TOTP), all 2274 items decrypt, org item reveal/copy, and Space from all three TUI panes.

🤖 Generated with Claude Code