#What's Changed

[Feature] apivault login records and prints the date this device's token expires, matching the 90-day lifetime the server now applies to newly approved CLI connections.
[Feature] apivault whoami shows the token's expiry date, and highlights it in yellow with a renewal reminder once fewer than 14 days remain. apivault --json whoami adds a tokenExpiresAt field.
[Improvement] A rejected request now explains itself: an expired token reports the date it lapsed, and a missing or revoked one says so, instead of surfacing the server's bare “Unauthorized”.
[Improvement] Rate-limited responses now report how long to wait. Wrong vault keys are throttled server-side, so keys get --reveal, keys add, env export and run translate the server's backoff into “try again in 7m” rather than a bare error.
[Improvement] Running apivault with no arguments distinguishes an expired token from being signed out, so the first line you see already tells you to run apivault login.
[Fix] --project and apivault projects use now work with a project slug, not just a project ID, matching what the flag's help text, apivault projects list and the documentation have always described.
[Fix] Realigned the CLI's local key-masking helper with the web app's, so a locally masked value and a server-sent preview can no longer render differently.