src/sdk/mod.rs

pub mod gitea;
pub mod tokens;
pub mod vault;
add sdk layer: vault client, token store, gitea API vault.rs — OpenBao client with kubernetes auth, KV v2 operations, automatic token refresh on 403. proper error handling on all paths. tokens.rs — vault-backed token storage with expiry validation. get_valid returns Result<Option> to distinguish vault errors from missing tokens. username mappings stay in sqlite (not secrets). gitea.rs — typed gitea API v1 wrapper with per-user PAT auto-provisioning via admin API. username discovery by direct match or email search. URL-encoded query params. handles 400 and 422 token name conflicts with delete+retry. 2026-03-22 14:59:25 +00:00			`pub mod gitea;`
			`pub mod tokens;`
			`pub mod vault;`