fix(vault): require --force to overwrite an existing secret

[bug-ops]

Summary

• AgeVaultProvider::set_secret_mut now takes an explicit overwrite: bool and returns AgeVaultError::AlreadyExists when a key already exists and overwrite wasn't requested, instead of silently replacing it — the guard lives in the shared zeph-vault crate, so every current and future caller (CLI, OAuth token refresh, durable-key wizard) must state its intent explicitly.
• CLI zeph vault set <key> <value> gained a --force flag; without it, an existing key is left untouched and the error names the key without ever printing its value.
• src/bootstrap/oauth.rs (managed OAuth token refresh) and src/init/durable.rs::store_durable_key (already gated by the pre-existing zeph init silently overwrites ZEPH_DURABLE_KEY, permanently orphaning existing durable journal payloads #5874/fix(init): require confirmation before overwriting ZEPH_DURABLE_KEY #5880 rotate-confirmation flow) pass overwrite: true explicitly, with an inline comment justifying why unconditional overwrite is correct there.

This closes the same defect class as the ZEPH_DURABLE_KEY incident (#5874/#5880), one layer down from that fix's wizard-specific gate — any current or future caller of the vault's set-style API now inherits the protection by default.

Closes #5955

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml -p zeph-vault -p zeph --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (828 passed)
• cargo test --doc -p zeph-vault (17 passed)
• Rustdoc gate (RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links") clean for zeph-vault
• New unit tests: set_secret_mut reject/replace paths (crates/zeph-vault/src/age.rs), CLI-level reject/overwrite (src/commands/vault.rs), CLI-parsing (src/tests.rs)
• .local/testing/playbooks/vault.md and .local/testing/coverage-status.md updated (main repo root) with a live-testing scenario for the overwrite guard