feat: Rust rewrite scaffolding with embedded kustomize+helm

Phase 0 of Python-to-Rust CLI rewrite:

- Cargo.toml with all dependencies (kube-rs, reqwest, russh, rcgen, lettre, etc.)
- build.rs: downloads kustomize v5.8.1 + helm v4.1.0 at compile time, embeds as bytes, sets SUNBEAM_COMMIT from git
- src/main.rs: tokio main with anyhow error formatting
- src/cli.rs: full clap derive struct tree matching all Python argparse subcommands
- src/config.rs: SunbeamConfig serde struct, load/save ~/.sunbeam.json
- src/output.rs: step/ok/warn/table with exact Python format strings
- src/tools.rs: embedded kustomize+helm extraction to cache dir
- src/kube.rs: parse_target, domain_replace, context management
- src/manifests.rs: filter_by_namespace with full test coverage
- Stub modules for all remaining features (cluster, secrets, images, services, checks, gitea, users, update)

23 tests pass, cargo check clean.

src/services.rs

@@ -0,0 +1,17 @@
+use anyhow::Result;
+
+pub async fn cmd_status(_target: Option<&str>) -> Result<()> {
+    todo!("cmd_status: pod health via kube-rs")
+}
+
+pub async fn cmd_logs(_target: &str, _follow: bool) -> Result<()> {
+    todo!("cmd_logs: stream pod logs via kube-rs")
+}
+
+pub async fn cmd_get(_target: &str, _output: &str) -> Result<()> {
+    todo!("cmd_get: get pod via kube-rs")
+}
+
+pub async fn cmd_restart(_target: Option<&str>) -> Result<()> {
+    todo!("cmd_restart: rollout restart via kube-rs")
+}