feat: liveness preflight, auto-run registration agent, vault in .neurosploit

- Preflight: abort a run early with '✗ target unreachable … is DOWN' when the
  probe gets no HTTP response, instead of running agents against a dead host;
  print '✓ target is UP' otherwise.
- When no --auth/creds are set on a web run, force account_registration_and_forms
  to run first so the authenticated surface is always attempted and visible.
- Move the credential vault to <cwd>/.neurosploit/vault/<run-id>.json (persistent
  project store) via new RunConfig.vault_dir; header now prints the vault path at
  launch. engagement_ops + finish() resolve paths through vault_paths().

TUTORIAL.md

@@ -326,7 +326,7 @@ agents know exactly what to submit.
   account they made. A test that would need many sign-ups is reported as a lead and
   stopped.
 - **Credential vault:** every account/credential the run generates is written to
-  **`<run-dir>/vault.json`** so you can consult the passwords later. Secrets are
+  **`.neurosploit/vault/<run-id>.json`** so you can consult the passwords later. Secrets are
   **masked in the report** and live only in the vault.
 - **Cleanup list:** the report includes an Info finding **"Test accounts created
   (DELETE after)"** listing each account and exactly **how it was created** — so you