Initial implementation of vault-os

Complete implementation across all 13 phases:

- vault-core: types, YAML frontmatter parsing, entity classification,
  filesystem ops, config, prompt composition, validation, search
- vault-watch: filesystem watcher with daemon write filtering, event
  classification
- vault-scheduler: cron engine, process executor, task runner with
  retry logic and concurrency limiting
- vault-api: Axum REST API (15 route modules), WebSocket with broadcast,
  AI assistant proxy, validation, templates
- Dashboard: React + TypeScript + Tailwind v4 with kanban, CodeMirror
  editor, dynamic view system, AI chat sidebar
- Nix flake with dev shell and NixOS module
- Graceful shutdown, inotify overflow recovery, tracing instrumentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

flake.nix

@@ -0,0 +1,102 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, rust-overlay }:
+    let
+      # NixOS module (system-independent)
+      nixosModule = import ./nix/module.nix self;
+    in
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ (import rust-overlay) ];
+        pkgs = import nixpkgs { inherit system overlays; };
+
+        rustToolchain = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [
+            "rust-src"
+            "rust-analyzer"
+            "clippy"
+            "rustfmt"
+          ];
+        };
+
+        # Dashboard build
+        dashboard = pkgs.buildNpmPackage {
+          pname = "vault-os-dashboard";
+          version = "0.1.0";
+          src = ./dashboard;
+          npmDepsHash = ""; # placeholder — run nix build once to get the hash
+          npmBuildScript = "build";
+          installPhase = ''
+            mkdir -p $out
+            cp -r dist/* $out/
+          '';
+        };
+
+        # Rust binary build
+        vault-os = pkgs.rustPlatform.buildRustPackage {
+          pname = "vault-os";
+          version = "0.1.0";
+          src = pkgs.lib.cleanSourceWith {
+            src = ./.;
+            filter = path: type:
+              let
+                relPath = pkgs.lib.removePrefix (toString ./. + "/") (toString path);
+              in
+              # Include Rust source, Cargo files, but not dashboard/node_modules
+              !(pkgs.lib.hasPrefix "dashboard/node_modules" relPath)
+              && !(pkgs.lib.hasPrefix "target" relPath)
+              && !(pkgs.lib.hasPrefix ".direnv" relPath);
+          };
+          cargoLock.lockFile = ./Cargo.lock;
+
+          nativeBuildInputs = [ pkgs.pkg-config ];
+          buildInputs = [
+            pkgs.openssl
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (
+            let sdk = pkgs.apple-sdk_15; in
+            [ sdk ]
+          );
+
+          # Embed the dashboard dist into the binary's asset directory
+          # preBuild = ''
+          #   mkdir -p dashboard/dist
+          #   cp -r ${dashboard}/* dashboard/dist/
+          # '';
+        };
+      in
+      {
+        packages = {
+          inherit vault-os dashboard;
+          default = vault-os;
+        };
+
+        devShells.default = pkgs.mkShell {
+          buildInputs = [
+            rustToolchain
+            pkgs.pkg-config
+            pkgs.openssl
+            pkgs.nodejs_22
+            pkgs.nodePackages.npm
+            pkgs.cargo-watch
+          ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin (
+            let sdk = pkgs.apple-sdk_15; in
+            [ sdk ]
+          );
+
+          env = {
+            RUST_BACKTRACE = "1";
+          };
+        };
+      }) // {
+        nixosModules.default = nixosModule;
+        nixosModules.vault-os = nixosModule;
+      };
+}