feat(vdb-menu): --apply installer + menu-first setup/update skills

Builds on !1 (merged) (the TUI scaffold wired to real data). Two commits:

--apply installer (98bc661)

• vdb_config.apply_config() writes resolved vault.root/db_path/enabled_groups into the engine constants (VAULT_ROOT+ENABLED_TABLE_GROUPS in vault-indexer.py, DB_PATH in vault-mcp-server.py). .bak backups, idempotent, refuses while vault.root is the placeholder.
• vdb_cli --apply previews; --apply --yes writes. Closes the gap --plan's 'run yourself' hint left open.
• open_database() resolves the real DB from config instead of the mock constant.
• Tests: dry-run, real write against a temp repo copy, idempotency, unset-root error.

Menu-first skills + docs (a70a374)

• vdb-setup: menu owns feature/table selection + vault root + inline answers; interview keeps use-context/integrations/models/custom-skills. Phase 4 uses --apply. vdb-config.yaml canonical (legacy vault-setup.json via --migrate).
• vdb-update: baseline SHA from vdb-config.yaml meta.template_sha (legacy fallback).
• CLAUDE.md, docs/setup-guide.md: menu-first paths.
• Known wart documented: vault_notify.py still reads vault-setup.json -> notifications (one legacy runtime consumer) — follow-up to migrate.

Full suite green (mise run test, exit 0).

🤖 Generated with Claude Code