feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/auth/m_cloud_stub.go

@@ -0,0 +1,11 @@
+//go:build !cloud
+
+package auth
+
+// Default build: cloud auth methods are compiled out (see m_cloud.go).
+// Listing them as "unavailable" rather than omitting them means a method
+// picker can show "AWS (built without cloud auth support — build with
+// -tags cloud)" instead of the option silently not existing.
+func init() {
+	registerUnavailable("built without cloud auth support (build with -tags cloud)", "aws", "azure", "gcp")
+}