Wraps the `algorand-pq` secrets engine added in the previous commit so the
service layer can reach Falcon-1024 keys the same way it already reaches
transit ed25519 ones. Pure addition: no existing method, call site or response
shape changes, and nothing yet calls these.

The four wrappers mirror their transit siblings — create (idempotent), read,
sign, list — and share one private request helper, since the plugin does not
imitate transit's quirks and so has none of the per-method special casing the
transit wrappers carry.

Two differences from those siblings are deliberate. Signatures come back raw:
the plugin emits no `vault:v1:` envelope, so nothing may run the transit prefix
split over them, and `decodeVaultSignature` in particular would reject every
Falcon signature on its 64-byte length assertion. And a missing key is an
answer rather than an error: `pqGetKey` returns `undefined` on 404 because the
account-type probe that follows reads a miss as "this user_id is not a PQ
account". `pqSign` keeps throwing on 404, since an unknown key there is a real
failure.

The mount comes from a new `VAULT_PQ_USERS_PATH` in `.env.template`, falling
back to `pawn/pq-users` the way the KV mount falls back to `secret`.
`development-init` seeds `.env` only when the file is absent, so without the
fallback every existing checkout would resolve an undefined mount against a
Vault that has the engine mounted correctly. The path stays a literal in
`development-init.ts` and the e2e suite: the former writes `.env` from the
template and so cannot consume the variable it creates, which is why its
transit paths are literals too.

Unit tests cover response parsing, the mount override and namespace header, the
404-to-`undefined` path, that the signing input is passed through base64
unmodified, and that a raw signature survives with no prefix stripped. Verified
against the running dev stack as well: a key created through these methods reads
back identically, re-creating it is idempotent, signing yields a 1226-byte
buffer, and the user AppRole is denied on sign while the manager succeeds.

Updates the requirements on [vue-router](https://github.com/vuejs/router) to permit the latest version.
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](https://github.com/vuejs/router/compare/v5.3.0...v5.3.1)

---
updated-dependencies:
- dependency-name: vue-router
  dependency-version: 5.3.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>