Move all existing functionality into a subcommand, in anticipation of other passphrase derivation schemes, with different settings.  (Automatically forward calls without a subcommand to the "vault" subcommand.)  Also store the settings in a file specific to the respective subsystem, instead of globally.  (Automatically fall back to, and migrate, the old global settings file if no subsystem-specific configuration was found.)