feat: re-add POST /secret write support (Login working)

Restore CreateCipher/CreateSecret with fixed syntax (quoted map keys,
pkcs7Unpad restored). Login write verified end-to-end.

internal/vaultwarden/api_client.go

@@ -1,6 +1,7 @@
 package vaultwarden
 
 import (
+	"bytes"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -755,6 +756,128 @@ func (ac *APIClient) doTokenRequest(data url.Values) (*TokenResponse, error) {
 	return &tokenResp, nil
 }
 
+// CipherInput describes a new vault item to create.
+type CipherInput struct {
+	Type     int               // 1=Login, 2=SecureNote, 3=Card, 4=Identity
+	Name     string
+	Notes    string
+	Username string
+	Password string
+	URI      string
+	Fields   map[string]string // custom fields (login only)
+}
+
+// CreateCipher encrypts and writes a new vault item via the Vaultwarden API.
+func (ac *APIClient) CreateCipher(in CipherInput) (string, error) {
+	if err := ac.EnsureValidToken(); err != nil {
+		return "", fmt.Errorf("ensure valid token: %w", err)
+	}
+	ac.mu.RLock()
+	token := ac.accessToken
+	key := ac.symKey
+	ac.mu.RUnlock()
+
+	encName, err := EncryptStr(in.Name, key)
+	if err != nil {
+		return "", fmt.Errorf("encrypt name: %w", err)
+	}
+	cipher := map[string]interface{}{
+		"type":            in.Type,
+		"name":            encName,
+		"notes":           nil,
+		"login":           nil,
+		"card":            nil,
+		"identity":        nil,
+		"fields":          nil,
+		"reprompt":        0,
+		"edit":            true,
+		"viewPassword":    true,
+		"favorite":        false,
+		"folderId":        nil,
+		"organizationId":  nil,
+		"collectionIds":   []string{},
+	}
+	if in.Notes != "" {
+		encNotes, e := EncryptStr(in.Notes, key)
+		if e == nil {
+			cipher["notes"] = encNotes
+		}
+	}
+
+	if in.Type == CipherTypeLogin {
+		login := map[string]interface{}{}
+		if in.Username != "" {
+			u, e := EncryptStr(in.Username, key)
+			if e == nil {
+				login["username"] = u
+			}
+		}
+		if in.Password != "" {
+			pw, e := EncryptStr(in.Password, key)
+			if e == nil {
+				login["password"] = pw
+			}
+		}
+		if in.URI != "" {
+			uri, e := EncryptStr(in.URI, key)
+			if e == nil {
+				login["uris"] = []map[string]interface{}{{"uri": uri, "match": nil}}
+			}
+		}
+		cipher["login"] = login
+		if len(in.Fields) > 0 {
+			fields := make([]map[string]interface{}, 0, len(in.Fields))
+			for k, v := range in.Fields {
+				fk, e1 := EncryptStr(k, key)
+				fv, e2 := EncryptStr(v, key)
+				if e1 == nil && e2 == nil {
+					fields = append(fields, map[string]interface{}{"name": fk, "value": fv, "type": 0})
+				}
+			}
+			cipher["fields"] = fields
+		}
+	} else if in.Type == CipherTypeSecureNote {
+		// notes already set
+	} else {
+		return "", fmt.Errorf("cipher type %d write not supported yet", in.Type)
+	}
+
+	body, err := json.Marshal(cipher)
+	if err != nil {
+		return "", fmt.Errorf("marshal cipher: %w", err)
+	}
+
+	req, err := http.NewRequest("POST", ac.baseURL+"/api/ciphers", bytes.NewReader(body))
+	if err != nil {
+		return "", fmt.Errorf("create request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+token)
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := ac.httpClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("create cipher request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("create cipher failed (HTTP %d): %s", resp.StatusCode, string(b))
+	}
+
+	var out struct {
+		ID   string `json:"Id"`
+		Name string `json:"Name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", fmt.Errorf("decode create response: %w", err)
+	}
+	if out.ID == "" {
+		return "", fmt.Errorf("create cipher returned empty id")
+	}
+	return out.ID, nil
+}
+
 // fetchProfileKey gets the encrypted symmetric key from the user's profile.
 // Used when API key login doesn't return the Key in the token response.
 func (ac *APIClient) fetchProfileKey() (string, error) {