feat: Rust rewrite scaffolding with embedded kustomize+helm

Phase 0 of Python-to-Rust CLI rewrite:

- Cargo.toml with all dependencies (kube-rs, reqwest, russh, rcgen, lettre, etc.)
- build.rs: downloads kustomize v5.8.1 + helm v4.1.0 at compile time, embeds as bytes, sets SUNBEAM_COMMIT from git
- src/main.rs: tokio main with anyhow error formatting
- src/cli.rs: full clap derive struct tree matching all Python argparse subcommands
- src/config.rs: SunbeamConfig serde struct, load/save ~/.sunbeam.json
- src/output.rs: step/ok/warn/table with exact Python format strings
- src/tools.rs: embedded kustomize+helm extraction to cache dir
- src/kube.rs: parse_target, domain_replace, context management
- src/manifests.rs: filter_by_namespace with full test coverage
- Stub modules for all remaining features (cluster, secrets, images, services, checks, gitea, users, update)

23 tests pass, cargo check clean.

src/update.rs

@@ -0,0 +1,12 @@
+use anyhow::Result;
+
+/// Compile-time commit SHA set by build.rs.
+pub const COMMIT: &str = env!("SUNBEAM_COMMIT");
+
+pub async fn cmd_update() -> Result<()> {
+    todo!("cmd_update: self-update from latest mainline commit via Gitea API")
+}
+
+pub fn cmd_version() {
+    println!("sunbeam {COMMIT}");
+}