feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/auth/registry.go

@@ -0,0 +1,86 @@
+package auth
+
+import "sort"
+
+// Registry holds every known Method, plus any that are named but
+// unavailable in this build (see the no_cloud build tag).
+type Registry struct {
+	methods     map[string]Method
+	unavailable map[string]string // name -> reason
+}
+
+var defaultRegistry = &Registry{
+	methods:     map[string]Method{},
+	unavailable: map[string]string{},
+}
+
+// register adds m to the default registry. Called from each method file's
+// init(), and from the cloud-methods files behind their build tags.
+func register(ms ...Method) {
+	for _, m := range ms {
+		defaultRegistry.methods[m.Name()] = m
+	}
+}
+
+// Register is the exported form of register, for methods that live in a
+// package auth cannot import without a cycle (internal/auth/oidc imports
+// auth for the Method interface itself, so it cannot self-register via
+// init() the way the raw methods in this package do). Callers that import
+// both packages — cmd/vault-tui, internal/cli — call this once at startup.
+func Register(ms ...Method) { register(ms...) }
+
+// registerUnavailable records a method name that exists conceptually but
+// was compiled out (e.g. -tags no_cloud), so pickers can show it greyed out
+// with a reason instead of it silently vanishing.
+func registerUnavailable(reason string, names ...string) {
+	for _, n := range names {
+		defaultRegistry.unavailable[n] = reason
+	}
+}
+
+// Default returns the process-wide method registry, populated by every auth
+// package file's init().
+func Default() *Registry { return defaultRegistry }
+
+// Get looks up a method by its stable name ("oidc", "userpass", ...).
+func (r *Registry) Get(name string) (Method, bool) {
+	m, ok := r.methods[name]
+	return m, ok
+}
+
+// Unavailable returns the reason a compiled-out method is unavailable, if any.
+func (r *Registry) Unavailable(name string) (string, bool) {
+	reason, ok := r.unavailable[name]
+	return reason, ok
+}
+
+// UnavailableAll returns every compiled-out method name mapped to its
+// reason, for pickers that want to list them (greyed out) alongside the
+// methods that are actually usable in this build.
+func (r *Registry) UnavailableAll() map[string]string {
+	out := make(map[string]string, len(r.unavailable))
+	for name, reason := range r.unavailable {
+		out[name] = reason
+	}
+	return out
+}
+
+// Names returns every registered method name, sorted.
+func (r *Registry) Names() []string {
+	out := make([]string, 0, len(r.methods))
+	for n := range r.methods {
+		out = append(out, n)
+	}
+	sort.Strings(out)
+	return out
+}
+
+// All returns every registered Method, sorted by name.
+func (r *Registry) All() []Method {
+	names := r.Names()
+	out := make([]Method, 0, len(names))
+	for _, n := range names {
+		out = append(out, r.methods[n])
+	}
+	return out
+}