Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

vault.json is generated from the FLAG injected at startup. Brute-force the 0000–9999 PIN SHA-256 and XOR-decrypt with the matching stream to recover the flag.
Inspect vault.json and identify the target record
brute-force the 0000–9999 PIN SHA-256 and XOR-decrypt with the matching stream
Verify that the reconstructed value has FLAG{...} format