feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/config/settings.go

@@ -0,0 +1,77 @@
+package config
+
+import "time"
+
+// Layer names used in Origin, most-significant first. Exported as
+// constants so callers can compare without typos.
+const (
+	LayerFlag     = "flag"
+	LayerEnv      = "env"
+	LayerProfile  = "profile"
+	LayerDefaults = "defaults"
+	LayerBuiltin  = "builtin"
+)
+
+// Origin records which layer produced a resolved value and the key that
+// carried it, so the UI/CLI can explain itself (e.g. status bar: "address:
+// VAULT_ADDR").
+type Origin struct {
+	Layer string
+	Key   string
+}
+
+// Settings is the fully flattened, precedence-resolved connection
+// configuration for one profile. internal/vault.New builds an *api.Client
+// from exactly this — it never re-reads env or config itself, which is what
+// makes the flag>env>profile>defaults>builtin precedence in resolve.go the
+// single source of truth (see resolve.go's package doc for why
+// api.DefaultConfig()'s own env-reading must not be relied upon instead).
+type Settings struct {
+	Profile   string
+	Address   string
+	Namespace string
+
+	CACert     string
+	CAPath     string
+	CACertPEM  []byte
+	ClientCert string
+	ClientKey  string
+	ServerName string
+	SkipVerify bool
+
+	Timeout          time.Duration
+	MaxRetries       int
+	MinRetryWait     time.Duration
+	MaxRetryWait     time.Duration
+	SRVLookup        bool
+	DisableRedirects bool
+	HTTPProxy        string
+	RateLimit        string
+	Headers          map[string]string
+
+	Auth  Auth
+	Token TokenOpts
+
+	ReadOnly           bool
+	MaskValues         bool
+	ConfirmDestructive bool
+	RequireCAS         bool
+	CacheTTL           time.Duration
+	TTLWarnBelow       time.Duration
+	ClipboardClear     time.Duration
+	BrowserCommand     string
+	Appearance         string
+	NoColor            bool
+
+	Origins map[string]Origin
+}
+
+// Fmt returns a short "value (source)" string for display, e.g.
+// "https://vault.example.com (VAULT_ADDR)". Falls back to just the key name
+// used by that layer when no origin was recorded for field.
+func (s *Settings) OriginOf(field string) Origin {
+	if s.Origins == nil {
+		return Origin{}
+	}
+	return s.Origins[field]
+}