#417 Docs: document VaultAnnotationProvider interface and extension opt-in pattern

Problem

PR #1434 (swamp-club#412) added first-class vault annotation support to swamp with new CLI commands (swamp vault annotate, swamp vault inspect) and a new VaultAnnotationProvider interface for extension vault providers. The user-facing documentation in swamp-club does not yet cover this.

Proposed solution

Update the vault reference documentation at content/manual/reference/vaults.md to document:

1. The VaultAnnotationProvider interface — its four methods (getAnnotation, putAnnotation, deleteAnnotation, listAnnotations) and the VaultAnnotation value object shape (url, notes, labels, updatedAt)
2. The CLI commands — swamp vault annotate <vault> <key> --url --note --label --clear and swamp vault inspect <vault> <key>, including merge semantics (only specified fields are updated, existing fields preserved)
3. Extension opt-in pattern — how extension vault authors implement annotation support by returning a provider that implements both VaultProvider and VaultAnnotationProvider via duck typing, with no schema or adapter changes needed

The how-to guide at content/manual/how-to/extensions.md may also need a section or example showing how a custom vault extension opts into annotation support.

Alternatives considered

None — documentation must reflect the new functionality.