feat: replace Bitwarden CLI with native Go API client (#2)

BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.

## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
  - AES-256-CBC + HMAC-SHA256 decryption
  - PBKDF2-SHA256 and Argon2id key derivation
  - HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)

## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)

## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars

## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)

## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)

Dockerfile

@@ -1,58 +1,31 @@
 # Build stage
 FROM golang:1.25-alpine AS builder
 
-# Install build dependencies
-RUN apk add --no-cache git ca-certificates tzdata
+RUN apk add --no-cache git ca-certificates
 
-# Set working directory
 WORKDIR /build
-
-# Copy go mod files
 COPY go.mod go.sum ./
-
-# Download dependencies
 RUN go mod download
-
-# Copy source code
 COPY . .
 
-# Build the binary
-# CGO_ENABLED=0 for static binary (no C dependencies)
-# -ldflags="-s -w" strips debug info to reduce binary size
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
     -ldflags="-s -w" \
     -o /build/vaultwarden-api \
     ./cmd/api
 
-# Final stage - minimal runtime image
-FROM node:24-alpine
+# Runtime stage — pure Alpine, no Node.js
+FROM alpine:3.21
 
-# Install CA certificates and wget
 RUN apk --no-cache add ca-certificates wget && \
-    npm install -g @bitwarden/cli && \
-    npm cache clean --force
+    adduser -D -H appuser
 
-# Set working directory
 WORKDIR /app
-
-# Copy binary from builder
 COPY --from=builder /build/vaultwarden-api .
 
-# Change ownership to existing node user
-RUN chown -R node:node /app
-
-# Set Bitwarden CLI data directory to /tmp (writable)
-ENV BITWARDENCLI_APPDATA_DIR=/tmp/.bitwarden
-
-# Switch to non-root user
-USER node
-
-# Expose port
+USER appuser
 EXPOSE 8080
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
     CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
 
-# Run the application
 ENTRYPOINT ["/app/vaultwarden-api"]