feat: liveness preflight, auto-run registration agent, vault in .neurosploit

- Preflight: abort a run early with '✗ target unreachable … is DOWN' when the
  probe gets no HTTP response, instead of running agents against a dead host;
  print '✓ target is UP' otherwise.
- When no --auth/creds are set on a web run, force account_registration_and_forms
  to run first so the authenticated surface is always attempted and visible.
- Move the credential vault to <cwd>/.neurosploit/vault/<run-id>.json (persistent
  project store) via new RunConfig.vault_dir; header now prints the vault path at
  launch. engagement_ops + finish() resolve paths through vault_paths().

neurosploit-rs/app/src/main.rs

@@ -699,6 +699,12 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
     std::fs::create_dir_all(&workdir).ok();
     cfg.workdir = Some(workdir.display().to_string());
     cfg.rl_path = Some(base.join("data").join("rl_state_rs.json").display().to_string());
+    // Credential vault lives in the project's .neurosploit store (persistent),
+    // NOT the transient run dir, so secrets are kept in one known place.
+    let vault_dir = std::env::current_dir().unwrap_or_else(|_| std::path::PathBuf::from("."))
+        .join(".neurosploit").join("vault");
+    std::fs::create_dir_all(&vault_dir).ok();
+    cfg.vault_dir = Some(vault_dir.display().to_string());
     // PoC scratch dir: agents write custom exploit scripts here (see doctrine).
     let pocs = workdir.join("pocs");
     std::fs::create_dir_all(&pocs).ok();
@@ -726,6 +732,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
     println!("  │  target : {}", cfg.target);
     println!("  │  models : {}", cfg.models.join(", "));
     println!("  │  output : {}", workdir.display());
+    println!("  │  vault  : {}/{run_id}.json (created test-account credentials; masked in the report)", vault_dir.display());
     if let Mode::Grey = mode {
         println!("  │  repo   : {}", cfg.repo.clone().unwrap_or_default());
     }