EasyVault v0.1.5

Added — single-use / N-use secrets (burn after read)

• A secret can cap how many times it may be fetched over the token API. Set
  Max reads when writing (GUI field, or {"options":{"max_reads":N}} on the
  KV write API). After the Nth read the version is destroyed and its ciphertext
  wiped — the next fetch returns 404. Read responses include
  metadata.reads_remaining. Useful for one-time credentials / OTP handoff.
• GUI viewing does not consume a use (it's management inspection); the secret
  view page shows a "single-use" badge with reads remaining. Migration 005 adds
  secrets.max_reads + read_count.

Changed — network ACL is per-token, not per-vault

• Removed the vault-level network ACL. IP/CIDR restrictions now live on each
  token and AppRole (their allowed_ips) — you say where a credential may be
  used from when you issue it. KV requests are checked against the token's IPs
  only; the vault Settings page no longer has a Network ACL card and
  POST /gui/vaults/:id/acl is gone.

Changed — vault Settings page

• Vault management (member access/assign/revoke, network ACL, key rotation) moved
  off the main vault page onto a dedicated Settings page
  (/gui/vaults/:id/settings, master / vault-admin only). The vault page now
  focuses on secrets, with a Settings button for managers.