Add a vault for saving whole forwarded posts

Completes TODO #5. Forwarding a post now asks whether to save it whole
or extract its media; sending media directly is unchanged.

Built on forwarding rather than copying file_ids. The bot already has
the post in its private chat with the owner, so it stores message ids
and forwards them back. forwardMessages takes a list and keeps an album
intact, which is what made the caption-plus-album case tractable; ids
must be strictly ascending, so they are sorted on the way out.

- Vault rows live in their own table and every query is scoped to an
  owner_id, so a guessed id cannot reach someone else's saved post.
  Nothing in the vault is searchable inline, moderated or federated,
  and the separate table makes that structural rather than a flag.
- Albums arrive as separate messages with no completion signal, so they
  are buffered by media_group_id behind a 1s debounce and prompt once.
- The add path now takes a list of items, so extracting an album stores
  every piece under one set of keywords instead of asking repeatedly.
- /vault searches keywords and the original caption, since the point of
  a vault is finding something you never got round to tagging.
- Retrieval failures are reported: a message id is a pointer into the
  chat, not a self-contained file_id, so clearing history breaks it.

Three near-identical keyword collectors are now one helper.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test_db.py

@@ -47,12 +47,15 @@ async def test_legacy_upgrade(tmp: str):
     db = load_db(path)
     await db.init_db()
 
-    assert user_version(path) == 3
+    # Pinned to the module so adding a migration does not require editing this.
+    assert user_version(path) == db.SCHEMA_VERSION
     rows = sorted((r["id"], r["keywords"]) for r in await db.search_media(""))
     assert rows == [(7, "cat,funny"), (9, "dog")], f"rows not preserved: {rows}"
     with sqlite3.connect(path) as c:
         statuses = {r[0] for r in c.execute("SELECT status FROM media")}
+        tables = {r[0] for r in c.execute("SELECT name FROM sqlite_master WHERE type='table'")}
     assert statuses == {"approved"}, f"upgraded rows must stay live: {statuses}"
+    assert "vault_items" in tables, "upgrading should create the vault table too"
     print("  legacy v1 database upgrades with ids, keywords and visibility intact")
 
 
@@ -91,7 +94,7 @@ async def test_fresh_and_idempotent(tmp: str):
     with sqlite3.connect(path) as c:
         sql = c.execute("SELECT sql FROM sqlite_master WHERE name='media'").fetchone()[0]
     assert "UNIQUE(owner_id, file_unique_id)" in sql
-    assert user_version(path) == 3
+    assert user_version(path) == db.SCHEMA_VERSION
 
     await db.init_db()
     await db.init_db()