Vault client + OAuth 2.1 PKCE + multi-vault switcher

[unforced]

Summary

• Full OAuth 2.1 auth code + PKCE S256 flow: RFC 8414 discovery → RFC 7591 dynamic client registration → PKCE authorize → callback → token exchange. Vault REQUIRES DCR (it validates client_id against its oauth_clients table) so this is the only way in.
• Multi-vault store (zustand) with tokens persisted per-vault URL in localStorage and active vault id in sessionStorage-adjacent state. Users can connect several vaults and switch without re-auth.
• Thin VaultClient over HTTP API — always sends Bearer ${token}, throws VaultAuthError on 401 so TanStack Query skips retries.
• Router shell with four routes: / (home), /add (URL entry → OAuth), /oauth/callback (code + state → token), /vaults (manage).
• Tests (33 total): RFC 7636 PKCE test vector, URL normalizer, discovery metadata validation, begin/complete OAuth orchestration with mocked fetch, VaultClient bearer-auth path, and App render.

Test plan

• bun run typecheck clean
• bun run lint clean
• bun run test — 33/33 pass
• bun run build succeeds
• bun run dev serves app at http://localhost:5173
• Manual: connect to a local vault via OAuth and verify tokens persist across reload
• Manual: add a second vault, switch via header select, confirm independent tokens
• Manual: remove a vault, confirm token cleared from localStorage

Notes

• No hardcoded vault conventions — client is fully agnostic, works for any vault URL.
• Bun's --localstorage-file flag (default without a path) installs a broken localStorage global that shadows jsdom's. Test setup polyfills with a simple in-memory Storage. Runtime storage functions are defensive (try/catch) so module init won't throw even if localStorage is unavailable.

🤖 Generated with Claude Code