Function default_vault_path 

pub fn default_vault_path() -> PathBuf

The default on-disk location of the sealed admin vault. Overridable with KINTSUGI_VAULT (tests, or a root-owned /etc/kintsugi/ path in the locked system posture). Shared by the CLI and the TUI so both read the same vault.