kryphos::vault::{VaultEntry, VaultHeader} are dead public types that shadow the real storage model

[forkwright]

Finding

crates/kryphos/src/vault.rs defines and publicly exports VaultEntry and VaultHeader — a credential-entry/header pair with a name: CompactString field held in plaintext and an encrypted_data: Vec<u8> ciphertext blob. Neither type is constructed anywhere outside vault.rs's own unit tests; the actual runtime persistence model lives in crates/kryphos/src/storage.rs as StoredEntry/StoredHeader/DecryptedEntry (the types #215 and #218 fixed). The near-identical naming between VaultEntry/StoredEntry and VaultHeader/StoredHeader is confusing during exactly the kind of review these two issues required: a reader grepping for "the entry struct" can land on the wrong, unused one.

Evidence

crates/kryphos/src/vault.rs:129 (pub struct VaultEntry) and :181 (pub struct VaultHeader), re-exported at crates/kryphos/src/lib.rs:23. Construction sites:

$ grep -rn "VaultEntry {" crates --include=*.rs
crates/kryphos/src/vault.rs:276:        VaultEntry {   // sample_entry() test helper
crates/kryphos/src/vault.rs:405:        let entry = VaultEntry {   // a test
$ grep -rn "VaultHeader::new" crates --include=*.rs
crates/kryphos/src/vault.rs:348, 368, 374   # all vault.rs's own tests

No caller outside vault.rs constructs either type, and neither is used by Vault::create/open/add/get/etc.

Why this matters

Public, exported, seemingly-live types that are actually dead code are a standing trap for the next reader or reviewer — including the two issues just fixed, where the correct fix path required distinguishing "the real on-disk shape" from this lookalike. EntryMetadata's own doc comment ("Metadata attached to a [VaultEntry]") is itself now stale/misleading, since EntryMetadata is actually attached to StoredEntry/DecryptedEntry/EntryInfo in practice.

Desired correction

Either delete VaultEntry/VaultHeader (and their tests) if they're confirmed vestigial, or if they're a deliberate future seam, mark them #[doc(hidden)]/gate them behind a feature and add a WHY comment naming what they're for. Fix EntryMetadata's doc comment to reference the type it's actually attached to either way. Done when: no public type in the crate both claims to model vault storage and has zero non-test construction sites.