#What's Changed

[Feature] Set APIVAULT_TOKEN and every command authenticates as that service token, ahead of the device token in ~/.apivault/token.json. Combined with the existing APIVAULT_KEY, this makes apivault run -- npm run build work unattended in CI.
[Improvement] apivault whoami reports the machine identity — token name, project, scopes and environment pin — instead of trying to name a user. It is the one command a pipeline can run to prove which credential it actually picked up.
[Improvement] apivault login and apivault logout refuse to run while APIVAULT_TOKEN is set, and say why. Previously login would have written a device token the next command ignored, and logout would have cleared one the caller never asked to sign out.