feat(vault-tui): implement KV client and service for managing secrets

- Added internal/vault/client.go for creating a Vault client with configuration settings.
- Introduced internal/vault/errors.go to classify Vault API errors for better UI handling.
- Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations.
- Implemented internal/vault/mounts.go to list and describe secret engine mounts.
- Developed internal/vault/service.go to provide a unified entry point for Vault operations.
- Added internal/vault/kv_test.go for comprehensive testing of KV operations.
- Introduced internal/ui/toast.go for transient notifications in the UI.
- Added renovate.json for dependency management and updates.

internal/vault/service.go

@@ -0,0 +1,32 @@
+package vault
+
+import (
+	"context"
+
+	"github.com/hashicorp/vault/api"
+)
+
+// Service is the single entry point the UI and headless CLI use for all
+// Vault data-plane operations. It exists so callers never touch *api.Client
+// or KV directly — this is the dependency boundary internal/ui relies on to
+// stay free of the hashicorp/vault/api import.
+type Service struct {
+	Client   *api.Client
+	KV       *KV
+	ReadOnly bool
+}
+
+// New wires a Service around an already-authenticated client. readOnly is
+// enforced here (via KV.ReadOnly), not just in the UI's disabled
+// keybindings — this is the boundary that actually blocks writes.
+func New(c *api.Client, readOnly bool) *Service {
+	return &Service{
+		Client:   c,
+		KV:       &KV{Client: c, ReadOnly: readOnly},
+		ReadOnly: readOnly,
+	}
+}
+
+func (s *Service) Mounts(ctx context.Context) ([]Mount, error) {
+	return ListMounts(ctx, s.Client)
+}