feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/cli/root.go

@@ -0,0 +1,60 @@
+package cli
+
+import (
+	"context"
+
+	"github.com/urfave/cli/v3"
+)
+
+// Root builds the full command tree. DefaultCommand launches the TUI when
+// vault-tui is invoked with no subcommand, matching the plan's "possible
+// without any subcommand" requirement.
+func Root(version string) *cli.Command {
+	root := &cli.Command{
+		Name:           "vault-tui",
+		Usage:          "Terminal UI for HashiCorp Vault",
+		Version:        version,
+		DefaultCommand: "ui",
+		// Deliberately no Sources: cli.EnvVars(...) here: internal/config.Resolve
+		// (and config.ResolvePath/SelectProfile for --config/--profile) already
+		// implements the full flag>env>profile>defaults>builtin chain with
+		// correct per-field Origin tracking. Letting urfave/cli additionally
+		// populate these flags from the same env vars would make cmd.IsSet()
+		// indistinguishable between "user passed --address" and "VAULT_ADDR is
+		// set", corrupting both precedence and the status bar's Origin display.
+		Flags: []cli.Flag{
+			&cli.StringFlag{Name: "config", Usage: "path to config.yaml"},
+			&cli.StringFlag{Name: "profile", Aliases: []string{"p"}},
+			&cli.StringFlag{Name: "address"},
+			&cli.StringFlag{Name: "namespace"},
+			&cli.StringFlag{Name: "token"},
+			&cli.StringFlag{Name: "ca-cert"},
+			&cli.StringFlag{Name: "client-cert"},
+			&cli.StringFlag{Name: "client-key"},
+			&cli.BoolFlag{Name: "tls-skip-verify"},
+			&cli.BoolFlag{Name: "read-only", Usage: "refuse all write operations"},
+			&cli.BoolFlag{Name: "write", Usage: "allow write operations (overrides a read-only default)"},
+			&cli.BoolFlag{Name: "no-env", Usage: "ignore VAULT_* environment variables"},
+			&cli.BoolFlag{Name: "no-color"},
+		},
+		Before: func(ctx context.Context, cmd *cli.Command) (context.Context, error) {
+			a, err := bootstrap(cmd)
+			if err != nil {
+				return ctx, err
+			}
+			return context.WithValue(ctx, appKey, a), nil
+		},
+		Commands: []*cli.Command{
+			uiCommand(),
+			loginCommand(),
+			logoutCommand(),
+			statusCommand(),
+			listCommand(),
+			readCommand(),
+			writeCommand(),
+			deleteCommand(),
+			configCommand(),
+		},
+	}
+	return root
+}