fix(cli): share Vault-relative path exclusions

Apply watcher and logical-target exclusions within the selected Vault so
hidden or database-like parent directories do not suppress monitoring.
Protect primary, previous, and view databases, and provide a runtime opt-in
for ordinary database-like directories without changing database ownership.

Cover hidden roots, symlink restarts, exclusion parity, and encrypted
CouchDB create, modify, and delete operations with regression tests.

Refs #1340

test/e2e-cli/tasks.json

@@ -20,6 +20,9 @@
     "test:daemon-startup": {
         "test": ["test-daemon-startup.ts"]
     },
+    "test:daemon-watch-paths": {
+        "test": ["test-daemon-watch-paths.ts"]
+    },
     "test:decoupled-vault": {
         "test": ["test-decoupled-vault.ts"]
     },