pure-Go smcli: Bitwarden/Vaultwarden client replacing upstream Rust bw

Full client-side crypto (PBKDF2/Argon2id master key, HKDF stretch,
AES-256-CBC+HMAC encstrings), password grant with TOTP 2FA, sync,
list/get/env/set/rm. Containerized (alpine, non-root), CI = gofmt/vet/
build/secret-scan, compose service ukrrs-secretsmgr-cli. Rust-era
scripts archived. Live-validated against pwvault.turnsys.com.

Ticket: https://projects.knownelement.com/issues/832

docker/Dockerfile.cli

@@ -0,0 +1,12 @@
+# KNELSecretsManager Go CLI — pure Go (no upstream Rust binary, no Node).
+FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY cli/go.mod cli/go.sum ./
+COPY cli/cmd/ ./cmd/
+RUN go build -ldflags="-s -w" -o /out/smcli ./cmd/smcli
+
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates && adduser -D -u 65532 app
+COPY --from=build /out/smcli /usr/local/bin/smcli
+USER 65532:65532
+

docker/compose.yaml

@@ -0,0 +1,26 @@
+# KNELSecretsManager Go CLI (ukrrs-secretsmgr-cli) — always-hot container per
+# house convention (Charles 2026-08-31): docker exec per invocation, never
+# docker run per call. Scoped ops only; NEVER bare compose down.
+#
+#   docker compose -f /path/to/this up -d smcli
+#   docker exec -i ukrrs-secretsmgr-cli smcli env creds/cloudron
+#
+# Credentials for the vault account come from a 0600 env file (SM_EMAIL,
+# SM_PASSWORD, SM_TOTP_SECRET, SM_SERVER) — never committed.
+name: knel-secretsmanager
+services:
+  smcli:
+    image: git.knownelement.com/knel/knel-secretsmanager-cli@sha256:41fe9bf298ba6d338ee658cf84f9914f7d607bfb27232c8deb2479c22ed0545d
+    container_name: ukrrs-secretsmgr-cli
+    restart: unless-stopped
+    entrypoint: ["sleep", "infinity"]
+    init: true
+    env_file:
+      - path: /home/reachableceo/.creds/smcli.env
+        required: false
+    environment:
+      SM_STATE_DIR: /data/state
+    volumes:
+      - smcli-state:/data/state
+volumes:
+  smcli-state: