Add fleet setup template and a one-shot project bootstrap script

SETUP.local.md.example is a fill-in-the-blanks runbook for rolling
keep out across real machines and projects (gitignored once copied to
SETUP.local.md — real vault keys/recipient ids/hostnames are fleet
topology, not something to commit). bootstrap-project.sh wraps push +
grant --read-only for one or more recipients into a single call for
onboarding a new project vault.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.gitignore

@@ -2,3 +2,8 @@ node_modules/
 dist/
 .env
 data/
+
+# Personal rollout notes — real vault keys, recipient ids, VPS hostnames.
+# Not secrets themselves, but fleet topology that doesn't belong in a
+# public repo. See SETUP.local.md.example for the template.
+SETUP.local.md