feat(sdk + vault-manager): introduce centralized Vault Manager gRPC service + Persys Go SDK alpha v0.0.1

[miladhzzzz]

Description

This PR introduces a centralized Vault Manager service and brings the Persys Go SDK to its first alpha release (v0.0.1).

Major Changes

1. Vault Manager (vault-manager/)

• New architecture: Vault Manager is now a long-running gRPC service acting as the central authority for certificate and identity management.
• Services (SDK, persysctl, agents, etc.) no longer need to inject VAULT_APPROLE_ROLE_ID / VAULT_APPROLE_SECRET_ID manually.
• Flow:
  • Service sends its service_name to Vault Manager.
  • Vault Manager handles AppRole authentication, secret retrieval, and PKI certificate issuance/renewal.
  • Returns required credentials and cert paths to the caller.
• Improved security posture and operational simplicity (no more scattered Vault credentials in env vars).

2. Persys Go SDK (sdk/)

• Full compatibility with all persysctl HTTP gateway commands.
• Extended client methods and fluent builders:
  • Clusters.List(), Clusters.Metrics()
  • Forgery() builder (upsert-project, trigger-build, test-webhook)
  • Workload scheduling, node management, etc.
• Updated identity provider (identity/) to integrate with the new Vault Manager gRPC API.
• Enhanced certmanager package to consume dynamic credentials from Vault Manager.
• Better options, examples, and documentation.

3. Shared Improvements

• Unified identity/cert management across SDK and platform services.
• Robust handling of temporary cert paths and development (insecure) mode.
• Cleaner separation of concerns: services only need their name + Vault Manager address.

Why This Change

• Simpler operations: No more manual credential management per service.
• Better security: Centralized control over Vault interactions and rotation.
• SDK as first-class citizen: All control-plane clients should go through the official SDK.

Testing

• Full local stack with new Vault Manager gRPC service.
• Certificate issuance/rotation flows.
• SDK usage in insecure + Vault-backed modes.
• Backward compatibility for existing direct Vault usage where needed.

Status: Alpha (v0.0.1-alpha). The new Vault Manager API is considered experimental until wider adoption.

---

Related Issues / Next Steps

• Follow-up: Refactor persysctl, agents, and other services to use Vault Manager + SDK.
• Add gRPC client generation / protobuf contracts for Vault Manager.
• Comprehensive documentation for service integration.

Reviewers: Please pay special attention to the new Vault Manager gRPC interface and SDK identity provider changes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[miladhzzzz]

/LGTM