VaultProxy CLI — fetch, inject, and proxy API keys
Single source of truth for the `emblem_*` MCP tool surface defined in `06-integration-contracts.md` §3.
Secure credential sidecar for MCP servers — injects auth from Vaultwarden without exposing secrets to AI agents