This is the first piece of Vault, a coming end-to-end encrypted place for passwords and private information. It adds the browser-side cryptography Vault will run on: a User Vault Key generated on the device, a Vault password (Argon2id) that wraps it, an independent recovery key that also wraps it, per-item encryption keys, and a versioned ciphertext format for individual items. All of it runs in the browser using libsodium - the Magpie server will only ever hold ciphertext, salts, and wrapped keys, never anything that can decrypt a Vault.
There is no /vault page yet. This lays the cryptographic ground the rest of Vault will be built on.