feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/config/env.go

@@ -0,0 +1,86 @@
+package config
+
+import (
+	"os"
+	"strconv"
+	"time"
+)
+
+// Getenv abstracts os.Getenv so tests can inject a fake environment.
+type Getenv func(string) (string, bool)
+
+// OSEnviron is the default Getenv backed by the real process environment.
+func OSEnviron(key string) (string, bool) { return os.LookupEnv(key) }
+
+// Env is every environment variable vault-tui recognises. Vault-native
+// names keep their VAULT_ prefix for CLI parity; vault-tui-only settings use
+// VAULT_TUI_. Kept as named constants (rather than inlined strings in
+// resolve.go) so the set is easy to audit and document in one place.
+const (
+	EnvAddress            = "VAULT_ADDR"
+	EnvNamespace          = "VAULT_NAMESPACE"
+	EnvCACert             = "VAULT_CACERT"
+	EnvCACertBytes        = "VAULT_CACERT_BYTES"
+	EnvCAPath             = "VAULT_CAPATH"
+	EnvClientCert         = "VAULT_CLIENT_CERT"
+	EnvClientKey          = "VAULT_CLIENT_KEY"
+	EnvTLSServerName      = "VAULT_TLS_SERVER_NAME"
+	EnvSkipVerify         = "VAULT_SKIP_VERIFY"
+	EnvClientTimeout      = "VAULT_CLIENT_TIMEOUT"
+	EnvMaxRetries         = "VAULT_MAX_RETRIES"
+	EnvSRVLookup          = "VAULT_SRV_LOOKUP"
+	EnvDisableRedirects   = "VAULT_DISABLE_REDIRECTS"
+	EnvHTTPProxy          = "VAULT_HTTP_PROXY"
+	EnvProxyAddr          = "VAULT_PROXY_ADDR"
+	EnvRateLimit          = "VAULT_RATE_LIMIT"
+	EnvToken              = "VAULT_TOKEN"
+	EnvConfigPathVaultCLI = "VAULT_CONFIG_PATH" // consumed by api/cliconfig, not by us directly
+
+	EnvTUIConfig   = "VAULT_TUI_CONFIG"
+	EnvTUIProfile  = "VAULT_TUI_PROFILE"
+	EnvTUINoEnv    = "VAULT_TUI_NO_ENV"
+	EnvTUIReadOnly = "VAULT_TUI_READ_ONLY"
+
+	// EnvAuthParamPrefix + strings.ToUpper(Field.Name) is consulted by
+	// internal/auth.Prefill alongside each Field's own EnvFallback list.
+	EnvAuthParamPrefix = "VAULT_TUI_AUTH_"
+)
+
+func envBool(get Getenv, key string) (bool, bool) {
+	v, ok := get(key)
+	if !ok || v == "" {
+		return false, false
+	}
+	b, err := strconv.ParseBool(v)
+	if err != nil {
+		return false, false
+	}
+	return b, true
+}
+
+func envDuration(get Getenv, key string) (time.Duration, bool) {
+	v, ok := get(key)
+	if !ok || v == "" {
+		return 0, false
+	}
+	d, err := time.ParseDuration(v)
+	if err != nil {
+		if secs, serr := strconv.Atoi(v); serr == nil {
+			return time.Duration(secs) * time.Second, true
+		}
+		return 0, false
+	}
+	return d, true
+}
+
+func envInt(get Getenv, key string) (int, bool) {
+	v, ok := get(key)
+	if !ok || v == "" {
+		return 0, false
+	}
+	n, err := strconv.Atoi(v)
+	if err != nil {
+		return 0, false
+	}
+	return n, true
+}