The vault uses the KV metadata API (getWithMetadata, put(key,value,{metadata}))
for its encrypted/hasPII flags; the minimal 0.1.12 KVStore omitted them, so
insurance/legal vaults didn't typecheck against the port. Complete the surface
(getWithMetadata + KVPutOptions) and implement it in createInMemoryKV. 171 tests.