feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/auth/m_cert.go

@@ -0,0 +1,42 @@
+package auth
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/api"
+)
+
+func init() { register(certMethod{}) }
+
+// certMethod is TLS client-cert auth. The certificate itself is supplied at
+// the transport layer via profile.tls.client_cert/client_key (see
+// config.Settings and internal/vault.NewClient) — this method's Login is
+// just the POST that tells Vault which cert role to match against.
+//
+// api/auth/cert has no tagged release (only a pseudo-version on the module
+// proxy), so this is implemented as a two-line raw request rather than
+// pulling in an unreleased dependency.
+type certMethod struct{}
+
+func (certMethod) Name() string         { return "cert" }
+func (certMethod) DisplayName() string  { return "TLS Certificate" }
+func (certMethod) DefaultMount() string { return "cert" }
+
+func (certMethod) Description() string {
+	return "Client-certificate auth. Configure tls.client_cert / tls.client_key on the profile first."
+}
+
+func (certMethod) Fields() []Field {
+	return []Field{
+		{Name: "name", Label: "Cert role name (optional)", Kind: FieldText},
+	}
+}
+
+func (certMethod) Login(ctx context.Context, c *api.Client, req Request) (*api.Secret, error) {
+	mount := mountOf(req, "cert")
+	data := map[string]interface{}{}
+	if name := req.Creds.Get("name"); name != "" {
+		data["name"] = name
+	}
+	return loginWrite(ctx, c, mount, "login", data)
+}