feat: re-add POST /secret write support (Login working)

Restore CreateCipher/CreateSecret with fixed syntax (quoted map keys,
pkcs7Unpad restored). Login write verified end-to-end.

internal/vaultwarden/client.go

@@ -197,6 +197,40 @@ func (c *Client) ClearCache() {
 	}
 }
 
+// CreateSecretInput is the public input for writing a new secret.
+type CreateSecretInput struct {
+	Type     int // 1=Login, 2=SecureNote
+	Name     string
+	Notes    string
+	Username string
+	Password string
+	URI      string
+	Fields   map[string]string
+}
+
+// CreateSecret writes a new vault item and refreshes the local cache so it is
+// immediately readable via GetSecret.
+func (c *Client) CreateSecret(in CreateSecretInput) (string, error) {
+	if c.api == nil {
+		return "", fmt.Errorf("vault API client not configured")
+	}
+	id, err := c.api.CreateCipher(CipherInput{
+		Type:     in.Type,
+		Name:     in.Name,
+		Notes:    in.Notes,
+		Username: in.Username,
+		Password: in.Password,
+		URI:      in.URI,
+		Fields:   in.Fields,
+	})
+	if err != nil {
+		return "", err
+	}
+	// Refresh cache so the new secret is immediately visible.
+	c.ClearCache()
+	return id, nil
+}
+
 // Stop stops the background sync goroutine.
 func (c *Client) Stop() {
 	close(c.stopSync)