V-1: the vault serves licence-put, keeping the caller's newest generation

A licence's grant and access token move into the vault (ADR 0550 §3), handed in two steps
with a key made for the call, as move-in does; the caller's generation is the record's,
an older one is refused, and secret-changed names the secret and its generation.

Builds: design 39 bus-and-switch §15, B3, B4, B5, B6

Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ

modules/mesh-vault/module.json

@@ -238,7 +238,8 @@
         "rotate-node",
         "node-account-confirm",
         "abandon",
-        "retire"
+        "retire",
+        "licence-put"
       ]
     }
   ],