EasyVault v0.1.6

Added — read-only tokens & AppRoles

• Tokens and AppRoles can be created read-only or read-write (Access
  selector on the create forms). A read-only credential can fetch secrets within
  its path/IP ACL but cannot write or delete them (POST/DELETE → 403).
  The token list shows the access mode. Existing tokens stay read-write
  (migration 007 adds writable, default true). This is the one capability the
  (deliberately dropped) policy engine would have added — without the machinery.

Added — audit-log retention (master only)

• The master can set an audit-log retention window (days; 0/blank = keep
  forever) on the audit page, with a Prune now button. A background task
  prunes on startup and every 6 hours. Prevents the audit log from growing
  unbounded. Settings live in a new settings table (migration 006).

Fixed — deleting a secret

• A fully-deleted secret no longer lingers in the vault's secret list. The
  listing now excludes paths whose only versions are soft-deleted (it already
  excluded destroyed/burned ones) — previously such a path stayed visible but
  led to a "not found" dead end.
• The GUI Delete now deletes the whole secret (all versions) in one
  action — relabelled "Delete secret" with a confirm — instead of one
  version at a time. Re-creating the same path afterwards starts a fresh live
  version. (The Vault-compatible DELETE /v1/secret/data/:path still
  soft-deletes a single version.)