Take the vault key out of the environment in the parent

Trog::Vault says it reads the key once, before there are any workers.  That was
only true if something loaded it at preload, and nothing did -- it arrived
through ProvisionedVirt, which is required lazily inside a request.  Each worker
scrubbed its own environment, which is still correct, and is not what the
module claims.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ADwKSaBSvUTdA3RtGQeNau

lib/TCMS.pm

@@ -32,6 +32,11 @@ use Trog::Log::DBI;
 
 use Trog::Auth;
 use Trog::Config;
+
+# Loaded here rather than where it is used, so that the vault key comes out of
+# the environment once, in the parent, before there is a worker to fork -- see
+# Trog::Vault.
+use Trog::Vault;
 use Trog::Data;
 use Trog::Themes;