feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/auth/m_kubernetes.go

@@ -0,0 +1,46 @@
+package auth
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/hashicorp/vault/api"
+)
+
+func init() { register(kubernetesMethod{}) }
+
+// defaultServiceAccountTokenPath is where a projected service account token
+// is normally mounted inside a pod.
+const defaultServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+
+type kubernetesMethod struct{}
+
+func (kubernetesMethod) Name() string         { return "kubernetes" }
+func (kubernetesMethod) DisplayName() string  { return "Kubernetes" }
+func (kubernetesMethod) DefaultMount() string { return "kubernetes" }
+
+func (kubernetesMethod) Fields() []Field {
+	return []Field{
+		{Name: "role", Label: "Role", Kind: FieldText, Required: true,
+			EnvFallback: []string{"VAULT_AUTH_KUBERNETES_ROLE"}},
+		{Name: "jwt_path", Label: "Service account token path", Kind: FieldPath,
+			Default: defaultServiceAccountTokenPath},
+	}
+}
+
+func (kubernetesMethod) Login(ctx context.Context, c *api.Client, req Request) (*api.Secret, error) {
+	mount := mountOf(req, "kubernetes")
+	jwtPath := req.Creds.Get("jwt_path")
+	if jwtPath == "" {
+		jwtPath = defaultServiceAccountTokenPath
+	}
+	jwt, err := os.ReadFile(jwtPath)
+	if err != nil {
+		return nil, fmt.Errorf("reading service account token from %s: %w", jwtPath, err)
+	}
+	return loginWrite(ctx, c, mount, "login", map[string]interface{}{
+		"role": req.Creds.Get("role"),
+		"jwt":  string(jwt),
+	})
+}