"""Tenant-scoped encrypted credential vault."""