Add end-to-end smoke and rewrite the README for v0

The smoke boots the fake Secrets Manager in a container and drives the
real binary from the host through a 0600 env file: login, listings, get
by name and uuid, failure paths, and a redaction sweep over every
captured output. README documents the implemented wire protocol, the
library surface keyproxy will call, the verified quickstart, and the
config table.

env.example

@@ -0,0 +1,16 @@
+# bitwarden-go machine credentials (copy to a 0600 file, e.g.
+# ~/.config/bitwarden-go/env, and fill in). Values are NEVER passed as
+# flags or arguments. Any *.env file in this repo is gitignored.
+#
+# Server root; identity endpoint is <url>/identity/connect/token and the
+# API is <url>/api/... . Default when unset: https://vault.bitwarden.com
+BW_SERVER_URL=https://vault.example.com
+
+# Machine access token as printed by Bitwarden Secrets Manager
+# ("0.<uuid>.<secret>:<key>"). This single value unlocks full decryption.
+BW_ACCESS_TOKEN=0.00000000-0000-4000-8000-000000000000.replace-me:AAAAAAAAAAAAAAAAAAAAAA==
+
+# OR the split form (no local key: only servers returning unencrypted
+# payloads work with it):
+# BW_CLIENTID=00000000-0000-4000-8000-000000000000
+# BW_CLIENTSECRET=replace-me