feat: Rust rewrite scaffolding with embedded kustomize+helm

Phase 0 of Python-to-Rust CLI rewrite:

- Cargo.toml with all dependencies (kube-rs, reqwest, russh, rcgen, lettre, etc.)
- build.rs: downloads kustomize v5.8.1 + helm v4.1.0 at compile time, embeds as bytes, sets SUNBEAM_COMMIT from git
- src/main.rs: tokio main with anyhow error formatting
- src/cli.rs: full clap derive struct tree matching all Python argparse subcommands
- src/config.rs: SunbeamConfig serde struct, load/save ~/.sunbeam.json
- src/output.rs: step/ok/warn/table with exact Python format strings
- src/tools.rs: embedded kustomize+helm extraction to cache dir
- src/kube.rs: parse_target, domain_replace, context management
- src/manifests.rs: filter_by_namespace with full test coverage
- Stub modules for all remaining features (cluster, secrets, images, services, checks, gitea, users, update)

23 tests pass, cargo check clean.

Cargo.toml

@@ -0,0 +1,56 @@
+[package]
+name = "sunbeam"
+version = "0.1.0"
+edition = "2024"
+description = "Sunbeam local dev stack manager"
+
+[dependencies]
+# Core
+anyhow = "1"
+tokio = { version = "1", features = ["full"] }
+clap = { version = "4", features = ["derive"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+serde_yaml = "0.9"
+
+# Kubernetes
+kube = { version = "0.99", features = ["client", "runtime", "derive", "ws"] }
+k8s-openapi = { version = "0.24", features = ["v1_32"] }
+
+# HTTP + TLS
+reqwest = { version = "0.12", features = ["json", "rustls-tls"] }
+rustls = "0.23"
+
+# SSH
+russh = "0.46"
+russh-keys = "0.46"
+
+# Crypto
+rsa = "0.9"
+pkcs8 = { version = "0.10", features = ["pem"] }
+pkcs1 = { version = "0.7", features = ["pem"] }
+sha2 = "0.10"
+hmac = "0.12"
+base64 = "0.22"
+rand = "0.8"
+
+# Certificate generation
+rcgen = "0.14"
+
+# SMTP
+lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }
+
+# Archive handling
+flate2 = "1"
+tar = "0.4"
+
+# Utility
+tempfile = "3"
+dirs = "5"
+chrono = { version = "0.4", features = ["serde"] }
+
+[build-dependencies]
+reqwest = { version = "0.12", features = ["blocking", "rustls-tls"] }
+sha2 = "0.10"
+flate2 = "1"
+tar = "0.4"