EasyVault v0.1.4

Added — AppRole auth (/v1/auth/approle/login)

• Machine login — a service exchanges a role_id + secret_id for a
  per-vault API token (Vault's auth envelope). The token is minted via the
  master escrow (no human session), scoped to the role's vault + path/IP ACL +
  TTL. Only SHA-256(secret_id) is stored (migration 004 adds approles +
  approle_secrets).
• Role management in the GUI (editor+, per vault, /gui/vaults/:id/approles)
  — create roles (name, allowed paths/IPs, token TTL), issue secret-ids (shown
  once, with a ready-to-run login curl), and delete roles.
• Token minting refactored into a shared mint helper so both session-created
  tokens and AppRole logins go through one path. New integration test (23 total).

Added — Vault token self-management (/v1/auth/token/*)

• GET/POST /v1/auth/token/lookup-self — metadata about the calling token
  (display name, policies/paths, ttl, renewable, expiry, vault) — what real
  Vault clients call to introspect their token.
• POST /v1/auth/token/revoke-self — the token revokes itself (204).
• POST /v1/auth/token/renew-self — extend a renewable token by an
  increment (seconds) or its stored renew period. Tokens created with a TTL
  are now renewable; the TTL is the default renew period (migration 003 adds
  api_tokens.renew_period). All authenticated by X-Vault-Token.
• New integration test (22 total).

Added — Windows service

• The Windows installer now registers EasyVault as a Windows service (via
  the WinSW wrapper, fetched in CI), set to
  start automatically and restart on failure — mirroring the Linux systemd unit.
  Data (database, TLS certs, config, logs) lives under %ProgramData%\EasyVault
  so it survives upgrades; uninstall stops/removes the service but preserves the
  data. The Start-menu shortcut now opens the dashboard (http://localhost:8200)
  instead of launching the binary directly.