Can I vibecode Ente Photos?

Build me a local encrypted photo vault to replace the backup part of Ente Photos. Requirements:

- Node.js 22 + TypeScript CLI named `vault` and a Fastify page on http://localhost:4850.
- `vault add <folder>` walks JPEG, HEIC, PNG and MP4 files, reads the capture date with `exifr`
  (file date as fallback) and skips files whose SHA-256 is already stored.
- Encryption: libsodium (`libsodium-wrappers`). One master key derived with Argon2id from a
  passphrase; each file gets its own random key, sealed with the master key, and is encrypted
  in chunks with crypto_secretstream. Thumbnails (`sharp`, 512 px) are encrypted the same way.
- Storage: ciphertext goes to an S3-compatible bucket through @aws-sdk/client-s3, with
  S3_ENDPOINT, S3_BUCKET, S3_KEY and S3_SECRET in .env. better-sqlite3 in ./data/vault.db holds
  the index (hash, date, size, object key, sealed file key) and is itself uploaded encrypted
  after every `add`.
- Viewer: the local page lists thumbnails by month, decrypts them in the server and streams the
  original on click. It asks for the passphrase once per session and holds the key in memory.
- `vault verify` downloads a random 2% of objects, decrypts them and compares hashes;
  `vault restore <dir>` writes every original back with its date.
- Single user. No accounts, no telemetry, local-first: the only outbound calls go to your bucket.
- Out of scope: phone auto-upload, sharing and public links, face grouping, family accounts.
- README: how to export photos from an iPhone or Android phone to a folder, where the passphrase
  must be kept (a lost passphrase means lost photos), and a restore test to run once.

Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.