feat: Rust rewrite scaffolding with embedded kustomize+helm

Phase 0 of Python-to-Rust CLI rewrite:

- Cargo.toml with all dependencies (kube-rs, reqwest, russh, rcgen, lettre, etc.)
- build.rs: downloads kustomize v5.8.1 + helm v4.1.0 at compile time, embeds as bytes, sets SUNBEAM_COMMIT from git
- src/main.rs: tokio main with anyhow error formatting
- src/cli.rs: full clap derive struct tree matching all Python argparse subcommands
- src/config.rs: SunbeamConfig serde struct, load/save ~/.sunbeam.json
- src/output.rs: step/ok/warn/table with exact Python format strings
- src/tools.rs: embedded kustomize+helm extraction to cache dir
- src/kube.rs: parse_target, domain_replace, context management
- src/manifests.rs: filter_by_namespace with full test coverage
- Stub modules for all remaining features (cluster, secrets, images, services, checks, gitea, users, update)

23 tests pass, cargo check clean.

src/users.rs

@@ -0,0 +1,53 @@
+use anyhow::Result;
+
+pub async fn cmd_user_list(_search: &str) -> Result<()> {
+    todo!("cmd_user_list: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_get(_target: &str) -> Result<()> {
+    todo!("cmd_user_get: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_create(_email: &str, _name: &str, _schema_id: &str) -> Result<()> {
+    todo!("cmd_user_create: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_delete(_target: &str) -> Result<()> {
+    todo!("cmd_user_delete: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_recover(_target: &str) -> Result<()> {
+    todo!("cmd_user_recover: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_disable(_target: &str) -> Result<()> {
+    todo!("cmd_user_disable: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_enable(_target: &str) -> Result<()> {
+    todo!("cmd_user_enable: ory-kratos-client SDK")
+}
+
+pub async fn cmd_user_set_password(_target: &str, _password: &str) -> Result<()> {
+    todo!("cmd_user_set_password: ory-kratos-client SDK")
+}
+
+#[allow(clippy::too_many_arguments)]
+pub async fn cmd_user_onboard(
+    _email: &str,
+    _name: &str,
+    _schema_id: &str,
+    _send_email: bool,
+    _notify: &str,
+    _job_title: &str,
+    _department: &str,
+    _office_location: &str,
+    _hire_date: &str,
+    _manager: &str,
+) -> Result<()> {
+    todo!("cmd_user_onboard: ory-kratos-client SDK + lettre SMTP")
+}
+
+pub async fn cmd_user_offboard(_target: &str) -> Result<()> {
+    todo!("cmd_user_offboard: ory-kratos-client + ory-hydra-client SDK")
+}