Move vaultctl config into project-local .vaultctl/ directory

[f3rdy]

Description

Replace the root-level .vaultctl.yml with a project-local .vaultctl/ directory. This gives all vaultctl-managed configuration (config, schemas, future mappings) a tidy single home, follows the dotfile-directory convention used by .github/, .vscode/, .husky/, etc., and prepares the ground for the CUE schema files introduced by #34.

Target Layout

project-root/
├── .vaultctl/
│   ├── config.yml              # was .vaultctl.yml at root
│   ├── vault.cue               # auto-generated schema baseline (#34)
│   └── vault.constraints.cue   # user-defined constraints (#34)
├── inventory/group_vars/all/
│   ├── vault.yml               # encrypted secrets — stays put
│   └── vault-keys.yml          # metadata next to secrets — stays put

What does NOT move

• vault.yml (encrypted secrets) — typically lives at the Ansible-expected path (inventory/group_vars/all/vault.yml), referenced by vault_file: in config.
• vault-keys.yml (metadata) — semantically belongs next to the secrets, same path.
• Password file (~/.ansible-vault-pass) — user-specific, never in the repo.

Scope

Clean cut, no backward compatibility:

• Update load_config() discovery in src/vaultctl/config.py to look for .vaultctl/config.yml only.
• Update vaultctl init to create the .vaultctl/ directory with config.yml.
• Update README and CLAUDE.md references from .vaultctl.yml to .vaultctl/config.yml.
• Drop any code paths that handle the old root-file location.

No migration command, no parallel discovery, no deprecation warnings — vaultctl has no production users yet, so the cleanest possible cut is appropriate.

Why before #34

Shipping vault.cue next to .vaultctl.yml (root) and then moving it shortly after would be churn. Doing this first means #34 lands at the final paths from day one.

Files

• src/vaultctl/config.py — load_config() discovery
• src/vaultctl/cli.py — init command
• README.md — config examples
• CLAUDE.md — architecture section

Priority

P1 (blocking #34)