build(vault): add zeroize for in-memory key wiping (T8.8 hardening)

src-tauri/Cargo.lock

@@ -5957,6 +5957,7 @@ dependencies = [
  "wasapi",
  "whisper-rs",
  "windows 0.58.0",
+ "zeroize",
 ]
 
 [[package]]

src-tauri/Cargo.toml

@@ -42,6 +42,7 @@ sha2 = "0.10"                                               # skip-if-unchanged
 argon2 = "0.5"
 chacha20poly1305 = "0.10"
 getrandom = "0.2"
+zeroize = "1"                                               # wipe key material from memory on lock
 keyring = { version = "3", optional = true }               # OS credential store (sync + AI creds)
 rmcp = { version = "0.16", optional = true, features = ["server"] }  # MCP server (ADR-0011)