Connections: stale entries after a NetBox tenant change, minutes without credentials, and no live refresh #253

Symptom

Moving a NetBox device to another tenant left its connection entries in both tenant folders, the new entries showed Login... for several minutes before switching to Connect, and the Connections page never changed until it was reloaded. Together the page is a stale picture of NetBox and OpenBao rather than a live one.

Three separate causes:

1. Stale entries after a tenant change. The NetBox webhook upserts into the folder computed from the device's current tenant. Nothing removes the copy from the previous tenant's folder, and NetBox's webhook context cannot produce the previous folder (the prechange snapshot carries the tenant id, not its slug), so this cannot be done from the NetBox side.
2. Minutes without credentials. NetBox never carries secrets, so synced entries are created without a password or key and a timer (rustguac-fill, every 5 minutes) adds the fleet key later. Until then has_credentials is false and the page prompts for a login.
3. No refresh. The page loads folders, entries and the credential status once and caches them for the life of the tab.

Fix

• PUT .../entries/:entry?move=true: after the write, same-named entries in every other folder of the scope are deleted and audited. The NetBox upsert webhooks use it, so an entry follows its device between tenant folders.
• Folder default credentials (.defaults beside .config, admin UI in the folder dialog, GET/PUT/DELETE .../defaults): per-session-type username, password or private key that entries without their own borrow at connect time; subfolders inherit per type. Listings report has_credentials: true with inherited_credentials: true, so a synced entry shows Connect from the moment the webhook fires. The tenant sync script sets them per tenant folder; the fill timer becomes a no-op.
• GET /api/addressbook/version: a counter bumped by every successful change through the API (entries, folders, config, defaults, moves, copies, bulk, credential variables). It costs no Vault read. The Connections page polls it every 3 seconds and reloads folders, entries, search index and credential status only when it moves, with a two-minute unconditional refresh for changes made by another instance or straight into Vault. Nothing reloads while a dialog is open or the tab is hidden; a hidden tab catches up when shown.

Folded into #255.