Display node vault capability status on node

Found while running Task 9865's AC-6 fleet sweep on dev (operator plane, Nodes → node → Properties). The node page shows only an "Identity key" fingerprint. A fingerprint does not prove that the node can hold keys now: `apps/api/app/routes/agent_nodevault.py` `_record_incapable` keeps a registered key when a later post says `capable=false`. An operator cannot tell a capable node from one that has since lost its uid split, unless NodeVault is set up in the node's org. Suggestions: - Show `nodevault_capable` next to the identity fingerprint on the node page, in the fleet's own words (for example "Holds keys" / "Can't hold keys — update Jaah"), plus when the node last reported it. - In the operator Nodes list, give NodeVault capability its own filter or column, so a fleet sweep is one screen rather than a page per node. - Show the full fingerprint as read-only text with copy, not as a form field in the Identity group. Out of scope: any change to how capability is computed or posted (daemon side), NodeVault crypto, and the Settings → NodeVault tenant page copy (N4). Done means: - On dev, an operator sees each node's capable flag on its page and can filter the Nodes list by it. A screenshot of both is in the report. - An api test covers the field in the node read model.

The node page now shows NodeVault capability (Holds keys / Can't hold keys, plus last report time) and the fingerprint as copyable text. The Nodes list has a NodeVault filter, and API tests cover both. Quick gate green, desktop and phone visual check done, PR #6874 queued to the lane. Deploy not watched.