bug: feat/kd-6b crashes app on startup — missing python-multipart dependency

Summary

feat/kd-6b (vault UI) fails at import time — the whole MuseHub app crashes on startup, not just a test failure — because musehub/api/routes/musehub/ui_vault.py uses a Form(...) dependency (line ~334) but python-multipart is not declared in either requirements.txt or pyproject.toml.

Reproduction

git checkout feat/kd-6b   # (muse checkout feat/kd-6b)
python3 -m pytest tests/test_kd6_vault_ui.py -q

RuntimeError: Form data requires "python-multipart" to be installed.
You can install "python-multipart" with:
    pip install python-multipart

This happens during FastAPI route registration at module import, so it's not gated behind any feature flag or vault-domain check — the entire app fails to start once this branch is merged, for every repo, not just knowtation-domain ones.

Fix

Add python-multipart to requirements.txt and pyproject.toml dependencies.

What's good in this branch (noted during review)

• path_grammar.py::validate_note_path correctly rejects path traversal (leading /, any .. segment) and restricts to note extensions — solid.
• ui_vault.router is correctly registered before the /{owner}/{repo_slug} wildcard in main.py.
• Feature is properly gated behind is_vault_domain_active() — 404s for repos not using the knowtation marketplace domain, so this isn't a general-purpose feature accidentally exposed everywhere.
• stdio_client.py's subprocess call uses an argument list (no shell=True), so no command-injection surface from the JSON-RPC payload.