Add the thin CLI: login, projects, secrets list, get

Read-path commands over the library. Credentials never come from flags
or arguments; get prints the bare value for $(...) plumbing and nothing
else ever touches stdout; stderr carries only redacted diagnostics. Exit
codes mirror keyproxy (0 ok, 1 usage/config, 2 auth or resolution
failure). CLI tests drive the fake server through a real 0600 env file.

cmd/bitwarden-go/main.go

@@ -0,0 +1,13 @@
+// Command bitwarden-go is the Secrets Manager read CLI. All behavior
+// lives in internal/cli; this file only wires stdio and exit codes.
+package main
+
+import (
+	"os"
+
+	"git.knownelement.com/ukrrs/mopac-bitwarden-go/internal/cli"
+)
+
+func main() {
+	os.Exit(cli.Run(os.Args[1:], os.Stdout, os.Stderr))
+}