Function prompt_password 

pub fn prompt_password() -> Result<Zeroizing<String>>

Get the vault password, trying in order:

1. ENVVAULT_PASSWORD env var (CI/CD)
2. OS keyring (if compiled with keyring-store feature)
3. Interactive prompt

Returns Zeroizing<String> so the password is wiped from memory on drop.