Bound vault sweep classification reads to selected vaults

[droplister]

Vault reconciliation can scan every sweep and probe the entire 1,000-row vault selection for each one. On production D1, a representative batch read 1,505,004 rows to return four results. Keep the selected vault batch as the outer join and seek sweeps through the existing source index; the same batch reads 3,008 rows and returns byte-identical results.

Four read-only production comparisons covered 1-, 400-, and 1,000-vault batches. Both 1,000-vault batches reduced reads by 99.8%; smaller batches kept the same read counts. No schema, classification, refresh cadence, or response changes. Tests now exercise funded and foreign vault sweeps plus an unrelated source.

Validation: root npm run check passed; API suite passed (451 passed, 34 skipped). Production execution time for the first measured batch fell from 106 ms to 8 ms; the second large batch fell from 78 ms to 4 ms. Monetary savings depend on the account's D1 read allowance and actual reconciliation frequency; no monthly dollar reduction is asserted from these probes.