Upsert Vault

Create or rotate the firm vault config.

Only firm staff can do this. The encrypted firm key in the request becomes the caller’s own key grant.