Add vault_sni config for container TLS hostname override

The web UI connects to the vault API via gRPC using the Docker
compose service name (e.g., "metacrypt:9443"), but the vault's TLS
certificate has SANs for "crypt.metacircular.net" and "localhost".
The new vault_sni config field overrides the TLS ServerName so
certificate verification succeeds despite the hostname mismatch.

Also updates metacrypt-rift.toml with vault_sni and temporarily
binds the web UI port to 0.0.0.0 for direct access until mc-proxy
is deployed.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -46,6 +46,10 @@ type WebConfig struct {
 	VaultGRPC string `toml:"vault_grpc"`
 	// VaultCACert is the path to the CA certificate used to verify the vault's TLS cert.
 	VaultCACert string `toml:"vault_ca_cert"`
+	// VaultSNI overrides the TLS server name used to verify the vault's
+	// certificate. Use when the dial address (e.g., a container hostname)
+	// does not match any SAN on the vault's TLS certificate.
+	VaultSNI string `toml:"vault_sni"`
 	// TLSCert and TLSKey are optional. If empty, the web server uses plain HTTP
 	// (suitable for deployment behind a TLS-terminating reverse proxy).
 	TLSCert string `toml:"tls_cert"`