Migrate all scripts to use vault cache

All NocoDB/Grist API scripts now use vault-env.sh instead of direct Vault queries:

Updated scripts:
- checks/check-agent.sh
- checks/check-memory-table.sh (already done)
- fixes/fix-columns.sh
- fixes/fix-severity-status.sh
- fixes/fix-status-col.sh
- fixes/fix-status-only.sh
- fixes/fix-type-col.sh
- fixes/fix-type-options.sh
- fixes/fix-type-v2.sh
- utils/debug-coloptions.sh
- utils/get-col-id.sh
- utils/get-columns.sh (already done)
- utils/recreate-type-column.sh
- utils/update-column-options.sh
- utils/update-type-col.sh (already done)
- get_grist_token.sh
- grist_api.sh
- refresh_tokens.sh
- store_grist_token.sh
- update_survey_dates.sh
- vault_api.sh (tries cache first, falls back to direct)
- vault_auth.sh (tries cache first, falls back to direct)

Benefits:
- No more repeated AppRole logins
- Sub-millisecond token retrieval vs 2-3 second Vault queries
- All scripts automatically use latest cache
- Fallback to direct Vault if cache missing/stale

Pattern:
  source vault-env.sh
  TOKEN=***  # instant from cache

Closes: vault cache migration

scripts/refresh_tokens.sh

@@ -1,44 +1,15 @@
 #!/bin/bash
-# Refresh Vault and Grist tokens
-# Tokens are written to files only, never exposed in stdout
+# refresh_tokens.sh - Refresh all vault cache tokens
+# This script forces a re-sync of the vault cache
 
-TOKEN_DIR="/home/jcbeasley/.openclaw/workspace/.tokens"
-VAULT_URL="https://beavault.beawit.net:8200"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-mkdir -p "$TOKEN_DIR"
-
-# Step 1: Authenticate to Vault
-curl -sk -X POST \
-  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
-  "$VAULT_URL/v1/auth/approle/login" \
-  > "$TOKEN_DIR/vault_auth_response.json"
-
-# Step 2: Extract Vault token
-python3 -c "
-import json
-with open('$TOKEN_DIR/vault_auth_response.json') as f:
-    data = json.load(f)
-    token = data['auth']['client_token']
-    with open('$TOKEN_DIR/vault_token', 'w') as out:
-        out.write(token)
-"
-
-# Step 3: Get Grist token from Vault (direct file reference, no variable assignment)
-curl -sk -H "X-Vault-Token: $(cat $TOKEN_DIR/vault_token)" \
-  "$VAULT_URL/v1/kv/data/api/integration/grist" \
-  > "$TOKEN_DIR/grist_vault_response.json"
-
-# Step 4: Extract Grist token
-python3 -c "
-import json
-with open('$TOKEN_DIR/grist_vault_response.json') as f:
-    data = json.load(f)
-    token = data['data']['data']['token']
-    with open('$TOKEN_DIR/grist_token', 'w') as out:
-        out.write(token)
-"
-
-# Step 5: Clean up
-rm -f "$TOKEN_DIR/vault_auth_response.json" "$TOKEN_DIR/grist_vault_response.json"
-
-echo "Tokens refreshed successfully"
+if [ -x "${SCRIPT_DIR}/vault-cache.sh" ]; then
+    echo "Refreshing vault cache..."
+    "${SCRIPT_DIR}/vault-cache.sh" invalidate all
+    "${SCRIPT_DIR}/vault-cache.sh" sync
+    echo "Cache refreshed"
+else
+    echo "Error: vault-cache.sh not found"
+    exit 1
+fi