feat: fingerprint unlock (Linux/fprintd, off by default)

[UnbreakableMJ]

vault unlock --fingerprint (and a TUI unlock-screen mode) re-unlock the keyring-held session after a fingerprint verified over D-Bus to the system fprintd, instead of re-typing the master password.

Design & posture

A fingerprint yields only match/no-match, never key material — so this can't cryptographically wrap a key at rest (that needs TPM2/FIDO2, out of scope). It instead gates the resume of the key already held in the kernel session keyring (the opt-in agent.session_keyring). With agent.fingerprint_unlock on:

• the agent no longer silently auto-resumes — it waits for a verified touch;
• idle-lock zeroises the in-memory key but keeps the keyring entry so a touch re-unlocks after a timeout (lifetime agent.fingerprint_ttl_secs);
• a manual vault lock still clears the keyring (master password required after);
• verification happens inside the agent (a client can't bypass it over the socket); enrollment is OS-level (fprintd-enroll) — Vault stores no template.

Posture (documented in PRD §7.3 + docs/fingerprint.md): the keyring entry is possessor-gated, so fingerprint unlock is convenience + user-presence, not a cryptographic boundary stronger than session_keyring, and strictly weaker than a master-password unlock. Default off, Linux-only, behind a new off-by-default fingerprint cargo feature (pulls zbus).

Surface

• vault-ipc: Request::UnlockFingerprint + FingerprintUnavailable/FingerprintFailed
• vault-config: agent.fingerprint_unlock / agent.fingerprint_ttl_secs (+ auto-spawn flags)
• vault-agent: fprintd zbus client (src/fingerprint.rs, feature-gated), dispatch, idle-lock/resume gating, unlock::resume_from_keyring
• vault-cli: vault unlock --fingerprint
• vault-tui: unlock-screen fingerprint mode (Tab cycles password → PIN → fingerprint)
• docs: docs/fingerprint.md, PRD §7.3, CHANGELOG, just fingerprint

Verification

Full just ci green — clippy --all-features compiles + lints the fingerprint/zbus code; cargo deny/cargo audit clean against the zbus tree. New tests cover the config keys + spawn flags, the resume gate, and the TUI mode/request. Live-verified: vault unlock --fingerprint against a real reader (Synaptics, enrolled finger) — master-password unlock → stop-agent → touch re-unlocks; manual vault lock then correctly reports "no resumable session".

Gracefully reports "unavailable" (→ master-password fallback) when the feature is off, non-Linux, no reader/fprintd/enrolled finger, an inactive/SSH session, or no live keyring session.

🤖 Generated with Claude Code