#What's Changed

[Feature] Set APIVAULT_TOKEN and every command authenticates as that service token, ahead of the device token in ~/.apivault/token.json. Combined with the existing APIVAULT_KEY, this makes apivault run -- npm run build work unattended in CI.
[Feature] apivault run and apivault env export take their environment from the token's pin when no --env is given, so a pipeline needs no configuration of its own. An explicit --env still wins, which keeps a contradiction visible as an error rather than quietly reading the wrong environment.
[Improvement] apivault whoami reports the machine identity — token name, project, scopes and environment reach — instead of trying to name a user. It is the one command a pipeline can run to prove which credential it actually picked up, so it always states the environment: a pinned token reads "Production only", an unpinned one "All environments" rather than staying silent about how far it reaches.
[Improvement] apivault login and apivault logout refuse to run while APIVAULT_TOKEN is set, and say why. Previously login would have written a device token the next command ignored, and logout would have cleared one the caller never asked to sign out.
[Improvement] A rejected service token no longer suggests apivault login, which refuses to run in that state. An unrecognised APIVAULT_TOKEN now says the value did not match a token — the usual cause being a truncated copy or a secret set on the wrong repository — while expiry, revocation and IP denials continue to name themselves exactly.
[Improvement] apivault projects list and apivault logs refuse up front under a service token instead of returning an authentication error indistinguishable from a bad credential. One spans every project on the account; the other is the audit trail that records machine access rather than exposing it.
[Fix] apivault keys add no longer prompts when there is no terminal to prompt on. It previously asked for optional notes even with every flag supplied, so a pipeline step hung until it was killed and no key was created. Missing values are now reported by flag name, --environment falls back to the token's environment pin, and keys update — which prompts for every field and has no flag equivalent — says it needs a terminal instead of aborting on a closed input.
[Fix] apivault keys delete without -f no longer stalls on its confirmation prompt in an unattended shell. It refuses and names the flag instead: deleting cannot be undone, so an absent human is not read as agreement. A command that needs a custom vault key it cannot prompt for now points at --vault-key and APIVAULT_KEY rather than waiting on input that will never arrive.