feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/cli/ui.go

@@ -0,0 +1,35 @@
+package cli
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/urfave/cli/v3"
+)
+
+// uiCommand launches the Bubbletea TUI. Implemented in internal/ui; wired
+// up once that package exists (see runUI, set from cmd/vault-tui/main.go's
+// init-time hook to avoid internal/cli importing the TUI toolkit itself and
+// thus keeping headless commands buildable/testable without it).
+var runUI func(ctx context.Context, a *App) error
+
+func uiCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "ui",
+		Usage: "launch the terminal UI (default when no subcommand is given)",
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			a, err := appFrom(ctx)
+			if err != nil {
+				return err
+			}
+			if runUI == nil {
+				return fmt.Errorf("the TUI is not available in this build")
+			}
+			return runUI(ctx, a)
+		},
+	}
+}
+
+// SetUIRunner lets cmd/vault-tui wire the real internal/ui implementation
+// into the "ui" command without internal/cli importing a TUI toolkit.
+func SetUIRunner(f func(ctx context.Context, a *App) error) { runUI = f }