VaultBackend
The app's view of the server's Stripe Customer + vault rail (roadmap #7) — mirrors PayoutBackend's shape: save/list/charge each do a server round-trip against core:protocol DTOs. Implemented in core:network.
A modern retelling of the five-gateway card_id vault pattern: save a card token once against a customer, charge it later without re-entering. The raw token never comes back from the server — only SavedInstrument's masked brand/last4.
Functions
POST /vault/{customerId}/instruments/{instrumentId}/charge. idempotencyKey must be stable across retries of the SAME logical charge attempt.
GET /vault/{customerId}/instruments — list saved instruments for a customer.
POST /vault/{customerId}/instruments. idempotencyKey must be stable across retries of the SAME logical save attempt, same contract as PaymentBackend.createOrder's.