pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

cli/cmd/smcli/util.go

@@ -0,0 +1,26 @@
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+)
+
+func toHex(b []byte) string { return hex.EncodeToString(b) }
+
+func fromHex(s string) ([]byte, error) {
+	return hex.DecodeString(s)
+}
+
+func hostnameSafe() string {
+	h, err := os.Hostname()
+	if err != nil {
+		return "unknown"
+	}
+	return h
+}
+
+func sha256Sum(b []byte) []byte {
+	s := sha256.Sum256(b)
+	return s[:]
+}