feat: replace Bitwarden CLI with native Go API client (#2)

BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.

## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
  - AES-256-CBC + HMAC-SHA256 decryption
  - PBKDF2-SHA256 and Argon2id key derivation
  - HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)

## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)

## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars

## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)

## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)

.env.example

@@ -1,58 +1,40 @@
-# Server Configuration
-API_PORT=8080
-ENVIRONMENT=development  # IMPORTANT: Change to 'production' for production deployments!
+# ===========================================
+# Vaultwarden API Configuration
+# ===========================================
+# Copy this file to .env and fill in your values.
+# NEVER commit your actual .env file!
 
-# Security - REQUIRED
-API_KEY=CHANGE-THIS-USE-32-CHARS-MINIMUM!!
+# --- Required ---
 
-# IP Whitelist (Optional but RECOMMENDED for production)
-# Comma-separated list of allowed IPs or CIDR ranges
-# Leave empty to allow all IPs (NOT recommended for production)
-# Examples:
-#   Single IP: ALLOWED_IPS=203.0.113.50
-#   Multiple IPs: ALLOWED_IPS=203.0.113.50,198.51.100.25
-#   CIDR range: ALLOWED_IPS=192.168.1.0/24
-#   Mix: ALLOWED_IPS=203.0.113.50,192.168.1.0/24,10.0.0.0/8
-ALLOWED_IPS=
-
-# Enable GitHub Actions IP ranges (automatically whitelists GitHub's IPs)
-# Set to 'true' to allow GitHub Actions to access your API
-# Updates every 24 hours automatically
-ENABLE_GITHUB_IP_RANGES=false
-
-# Trusted Proxy Configuration
-# Specify the IP of your reverse proxy (Nginx Proxy Manager, Traefik, etc.)
-# Default: only localhost (127.0.0.1, ::1)
-# Note: The actual client IP is extracted from X-Forwarded-For header
-# Examples:
-#   Docker networks: TRUSTED_PROXY_IP=172.16.0.0/12
-#   Single proxy: TRUSTED_PROXY_IP=172.18.0.5
-#   Multiple proxies: TRUSTED_PROXY_IP=172.18.0.5,192.168.1.10
-TRUSTED_PROXY_IP=
-
-# CORS Configuration
-# IMPORTANT: Update this for production deployments
-CORS_ALLOWED_ORIGINS=http://localhost:3000
-
-# Vaultwarden Configuration - REQUIRED
-# URL of your Vaultwarden instance (no trailing slash)
+# Your Vaultwarden instance URL
 VAULTWARDEN_URL=https://vault.yourdomain.com
 
-# Authentication - Choose ONE method:
-# Method 1: API Key (Recommended - bypasses 2FA, auto-login on startup)
-# Get your API key from: Account Settings -> Security -> Keys -> View API Key
-VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
-VAULTWARDEN_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
+# Your Vaultwarden login email
+VAULTWARDEN_EMAIL=you@example.com
+
+# Your Vaultwarden master password
 VAULTWARDEN_PASSWORD=your-master-password
 
-# Method 2: Pre-generated session token (Alternative - will expire)
-# VAULTWARDEN_ACCESS_TOKEN=your-session-token-here
+# API key for authenticating to this service (min 32 chars)
+# Generate one: openssl rand -base64 32
+API_KEY=
 
-# Performance & Caching
-# How long to cache secrets in memory (reduces API calls)
-# Set to 0 to disable caching (more secure but slower)
-CACHE_TTL=5m
+# --- Optional ---
 
-# Timeouts
-READ_TIMEOUT=10s
-WRITE_TIMEOUT=10s
+# Restrict access to specific IPs/CIDRs
+# ALLOWED_IPS=192.168.1.0/24,10.0.0.1
+
+# Auto-whitelist GitHub Actions IPs (for CI/CD)
+# ENABLE_GITHUB_IP_RANGES=true
+
+# Trusted reverse proxy IPs (for correct client IP detection)
+# TRUSTED_PROXY_IP=172.16.0.0/12
+
+# How often to re-sync the vault (default: 5m)
+# SYNC_INTERVAL=5m
+
+# Environment (development shows detailed errors, production hides them)
+# ENVIRONMENT=production
+
+# Enable debug logging (shows secret names in logs — NOT for production!)
+# DEBUG=false