EasyVault v0.1.2

Added — dark / light theme

• The GUI palette is now driven by CSS variables with a light theme in
  addition to the existing dark one. A ◐ toggle in the header switches and
  persists the choice in localStorage; the default follows the OS
  prefers-color-scheme. A tiny inline head script applies the theme before
  first paint (no flash). No dependencies.

Added — full audit coverage + emergency seal

• GUI actions are now audited too (not just the token API): secret READ
  (incl. 404), WRITE, DELETE, plus LOGIN, GRANT, REVOKE, ROTATE and
  SEAL — recorded with actor_type = gui_session and the acting user, the
  same HMAC-signed rows shown in /gui/audit.
• Re-seal (POST /gui/seal, master only) — an emergency lockdown that drops
  the master key from memory and seals the instance immediately (the SEAL
  event is audited just before the key is wiped). Surfaced as a "Seal instance"
  button on the dashboard; the API core is sys::perform_seal.