feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/auth/oidc/nonce.go

@@ -0,0 +1,26 @@
+package oidc
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+)
+
+const base62Alphabet = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+
+// randomNonce returns an n-character base62 string from crypto/rand, used
+// for client_nonce. Deliberately not a dependency on
+// github.com/hashicorp/go-secure-stdlib/base62 — this is the same
+// crypto/rand-backed generation in about ten lines.
+func randomNonce(n int) string {
+	b := make([]byte, n)
+	max := big.NewInt(int64(len(base62Alphabet)))
+	for i := range b {
+		idx, err := rand.Int(rand.Reader, max)
+		if err != nil {
+			panic(fmt.Sprintf("oidc: crypto/rand unavailable: %v", err))
+		}
+		b[i] = base62Alphabet[idx.Int64()]
+	}
+	return string(b)
+}