pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

cli/go.mod

@@ -0,0 +1,7 @@
+module git.knownelement.com/KNEL/KNELSecretsManager/cli
+
+go 1.23
+
+require golang.org/x/crypto v0.31.0
+
+require golang.org/x/sys v0.28.0 // indirect