Provide a safer non-password unlock path for Boring Computer smoke tests

[dudetru25]

Problem

The Boring/Firecracker worker is healthy and has KVM available, but authenticated control-plane tests stop when the local WispKey vault is locked. The current CLI unlock flow requires the vault master password for each new session, which makes routine headless-browser smoke tests unnecessarily cumbersome.

The personal credential can be used only after the vault is unlocked; it cannot unlock the vault itself.

Goal

Provide an easier, security-preserving unlock path for authorized local automation and Boring Computer verification.

Requirements

• Prefer an OS-backed unlock mechanism on macOS, such as Keychain or an equivalent user-presence-backed protector, if supported by the platform.
• If OS-backed unlock is unavailable, support an explicitly bounded WispKey session or local proxy flow with a clear timeout, revocation, and lock operation.
• Keep the master password and raw credential values out of command arguments, URLs, logs, repository files, and guest environments.
• Preserve project/partition scoping, host/path policy enforcement, and audit events.
• Make it possible to run the complete smoke test: unlock or authorize the session, authenticate the Boring control API, launch one approved ephemeral guest, exercise a browser interaction, capture evidence, and clean up the guest.
• Document recovery behavior when the OS protector or local proxy is unavailable.

Non-goals

• Bypassing vault encryption or authorization.
• Persisting the master password in plaintext.
• Exposing the Boring control API, Docker API, CDP, or Firecracker guests publicly.
• Granting Boring guests access to private services or production credentials.

Acceptance criteria

• A user can authorize a local WispKey session without repeatedly typing the vault master password during the configured session lifetime.
• The unlock path has an explicit expiry/revocation mechanism and produces auditable events.
• Personal credentials remain injected only through controlled channels.
• A documented Boring Computer browser smoke test passes from authenticated control-plane access through guest cleanup.
• Locked-vault, expired-session, revoked-session, and unauthorized-scope cases fail closed with clear errors.

Migrated from rankupgames/uplink-dashboard#6. GitHub cannot directly transfer issues from a private repository to this public repository.