feat: re-add POST /secret write support (Login working)

Restore CreateCipher/CreateSecret with fixed syntax (quoted map keys,
pkcs7Unpad restored). Login write verified end-to-end.

internal/handlers/handlers.go

@@ -270,3 +270,65 @@ func (h *Handler) RefreshCache(c *fiber.Ctx) error {
 		"message": "cache cleared successfully",
 	})
 }
+
+// CreateSecret handles POST /secret. Body (JSON):
+//
+//	{
+//	  "type": 1,            // 1=Login (default), 2=SecureNote
+//	  "name": "...",        // required
+//	  "notes": "...",       // secure note body (type 2) or login notes
+//	  "username": "...",    // login only
+//	  "password": "...",    // login only
+//	  "uri": "...",         // login only
+//	  "fields": {"k":"v"}   // login custom fields (optional)
+//	}
+func (h *Handler) CreateSecret(c *fiber.Ctx) error {
+	var body struct {
+		Type     int               `json:"type"`
+		Name     string            `json:"name"`
+		Notes    string            `json:"notes"`
+		Username string            `json:"username"`
+		Password string            `json:"password"`
+		URI      string            `json:"uri"`
+		Fields   map[string]string `json:"fields"`
+	}
+	if err := c.BodyParser(&body); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid JSON body"})
+	}
+
+	body.Name = strings.TrimSpace(body.Name)
+	if body.Name == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "name is required"})
+	}
+	if !validators.IsValidSecretName(body.Name) {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "invalid secret name format"})
+	}
+
+	if body.Type == 0 {
+		body.Type = 1 // default to Login
+	}
+	if body.Type != 1 && body.Type != 2 {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "only Login (1) and SecureNote (2) are supported for writing"})
+	}
+
+	id, err := h.vaultClient.CreateSecret(vaultwarden.CreateSecretInput{
+		Type:     body.Type,
+		Name:     body.Name,
+		Notes:    body.Notes,
+		Username: body.Username,
+		Password: body.Password,
+		URI:      body.URI,
+		Fields:   body.Fields,
+	})
+	if err != nil {
+		logger.Error.Printf("Failed to create secret (requested by IP: %s): %v", c.IP(), err)
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": err.Error()})
+	}
+
+	return c.Status(fiber.StatusCreated).JSON(fiber.Map{
+		"status":  "created",
+		"id":      id,
+		"name":    body.Name,
+		"type":    body.Type,
+	})
+}