overview: show when each vault was last updated, and by whom

Was silently dropping updatedAt/updatedBy even though the server
already returned them — the CLI just never printed them. Also
resolves updatedBy to the recipient's label server-side (matching how
grants already show a label alongside the recipient id) instead of
printing a bare recipient_id.

Verified against a live server: overview now prints "demo/production
(updated <iso timestamp> by test-box)" instead of omitting that line
entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/cli/commands/recipient.ts

@@ -31,7 +31,9 @@ export async function adminOverview(): Promise<void> {
   console.log('\nvaults:');
   if (!data.vaults.length) console.log('  none yet.');
   for (const v of data.vaults) {
-    console.log(`  ${v.vaultKey}`);
+    const updated = v.updatedAt ? new Date(v.updatedAt * 1000).toISOString() : 'unknown';
+    const by = v.updatedByLabel ?? v.updatedBy ?? 'unknown';
+    console.log(`  ${v.vaultKey}  (updated ${updated} by ${by})`);
     for (const g of v.grants) {
       console.log(`    ${g.canWrite ? 'rw' : 'r-'}  ${g.recipientId}  ${g.label ?? '(unknown recipient)'}`);
     }

src/server/adminRoutes.ts

@@ -57,6 +57,7 @@ router.get('/overview', (_req, res) => {
     vaultKey: v.vault_key,
     updatedAt: v.updated_at,
     updatedBy: v.updated_by,
+    updatedByLabel: byId.get(v.updated_by)?.label ?? null,
     grants: listGrantsForVault(v.vault_key).map(g => ({
       recipientId: g.recipient_id,
       label: byId.get(g.recipient_id)?.label ?? null,