Railbase core v0.5.6

Core fixes shipped since v0.5.5 (all field-found, all with regression tests):

• realtime: strict-mode SSE no longer erases plugin domain-event payloads to {"action":"","record":{}} — non-RecordEvent topics pass through natively. Unblocks live frontends for chat/link/ptp/inventory events.
• plugin-manager: the OOP realtime uplink now routes through the realtime broker, so an out-of-process plugin's domain events reach browser SSE exactly like an in-process build (ADR-001 deployment invariance). Required by railbase-link.
• serve: --vault-path / RAILBASE_VAULT_PATH is honored (previously the server always opened /railbase.vault while the CLI honored the flag — the two could silently operate on different files).
• boot: runtime-created users auth collections survive restarts (the legacy demote no longer eats operator-created collections); hydration is logged; create/update read-back-verify persisted specs.