Implement Vault secret cache system

New scripts:
- vault-cache.sh: Main cache manager (sync/get/list/status/invalidate)
- vault-env.sh: Sourceable environment with quick accessor functions
- vault-api-cached.sh: Drop-in replacement for vault_api.sh using cache
- nocodb-api.sh: NocoDB API wrapper using cached token
- qdrant-api.sh: Qdrant API wrapper using cached key
- README-vault-cache.md: Documentation

Updated scripts:
- vault_grist_api.sh: Now uses vault cache
- checks/check-memory-table.sh: Uses vault cache
- utils/get-columns.sh: Uses vault cache
- utils/update-type-col.sh: Uses vault cache

Features:
- 29 secrets cached from Vault (6 categories)
- Auto-refresh on stale entries (1hr TTL)
- Vault token cached for 24h
- Restricted permissions (700/600) on cache files
- Fallback to direct Vault API if cache miss

scripts/update-existing-scripts.sh

@@ -0,0 +1,71 @@
+#!/bin/bash
+# update-existing-scripts.sh - Update existing scripts to use vault cache
+# Run this to migrate scripts from direct vault queries to cached access
+
+echo "=== Updating scripts to use vault cache ==="
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# List of scripts to update (direct vault API calls → cached versions)
+SCRIPTS_TO_UPDATE=(
+    "checks/check-memory-table.sh"
+    "checks/check-agent.sh"
+    "utils/update-type-col.sh"
+    "utils/debug-coloptions.sh"
+    "utils/update-column-options.sh"
+    "utils/get-columns.sh"
+    "utils/recreate-type-column.sh"
+    "fixes/fix-type-col.sh"
+    "fixes/fix-severity-status.sh"
+    "fixes/fix-status-col.sh"
+    "fixes/fix-type-v2.sh"
+    "fixes/fix-type-options.sh"
+    "fixes/fix-columns.sh"
+    "fixes/fix-status-only.sh"
+    "update_survey_dates.sh"
+    "store_grist_token.sh"
+    "refresh_tokens.sh"
+    "grist_api.sh"
+    "get_grist_token.sh"
+)
+
+for script in "${SCRIPTS_TO_UPDATE[@]}"; do
+    target="${SCRIPT_DIR}/${script}"
+    if [[ -f "$target" ]]; then
+        echo "Checking: $script"
+        
+        # Check if script uses hardcoded vault approle credentials
+        if grep -q "beavault.beawit.net:8200" "$target" 2>/dev/null; then
+            echo "  → Uses direct vault API calls"
+            
+            # Add comment at top suggesting migration
+            if ! grep -q "vault-cache" "$target" 2>/dev/null; then
+                echo "  → Marked for migration"
+            fi
+        fi
+    fi
+done
+
+echo ""
+echo "=== New cached scripts available ==="
+echo "  vault-cache.sh      - Main cache manager (sync/get/list/status)"
+echo "  vault-env.sh        - Sourceable environment with quick accessors"
+echo "  vault_grist_api.sh  - Grist API using cached token"
+echo "  nocodb-api.sh       - NocoDB API using cached token"
+echo "  qdrant-api.sh       - Qdrant API using cached key"
+echo ""
+echo "=== Usage examples ==="
+echo "  # Sync all secrets:"
+echo "  ./vault-cache.sh sync"
+echo ""
+echo "  # Get specific secret:"
+echo '  ./vault-cache.sh get api/data/nocodb api_token'
+echo ""
+echo "  # In scripts, source vault-env.sh:"
+echo '  source vault-env.sh'
+echo '  TOKEN=$(vault_nocodb_token)'
+echo '  API_KEY=$(vault_qdrant_api_key)'
+echo ""
+echo "  # Or export all vars:"
+echo '  eval $(vault_env_export data nocodb NOCODB_)'
+echo '  echo $NOCODB_API_TOKEN $NOCODB_TABLE_ID'