Move all existing functionality into a subcommand, in anticipation of other passphrase derivation schemes, with different settings.  Automatically forward calls without a subcommand to the "vault" subcommand.

  Also store the settings in a file specific to the respective subsystem, instead of globally.  Automatically fall back to, and migrate, the old global settings file if no subsystem-specific configuration was found.