Module credentials 

Encrypted credential vault using SQLite + AES-256-GCM.

Key management

The vault key is loaded from (in order of priority):

1. CORTEX_VAULT_KEY_FILE env → reads key from the file path
2. CORTEX_VAULT_KEY env → uses the value directly (visible in ps, not recommended)
3. Falls back to a machine-specific default (not suitable for production secrets)

Using CORTEX_VAULT_KEY_FILE is recommended because file paths are not visible in the process list, unlike environment variable values.

Structs

CredentialVault

Encrypted credential store backed by SQLite.