Implement Vault secret cache system

New scripts:
- vault-cache.sh: Main cache manager (sync/get/list/status/invalidate)
- vault-env.sh: Sourceable environment with quick accessor functions
- vault-api-cached.sh: Drop-in replacement for vault_api.sh using cache
- nocodb-api.sh: NocoDB API wrapper using cached token
- qdrant-api.sh: Qdrant API wrapper using cached key
- README-vault-cache.md: Documentation

Updated scripts:
- vault_grist_api.sh: Now uses vault cache
- checks/check-memory-table.sh: Uses vault cache
- utils/get-columns.sh: Uses vault cache
- utils/update-type-col.sh: Uses vault cache

Features:
- 29 secrets cached from Vault (6 categories)
- Auto-refresh on stale entries (1hr TTL)
- Vault token cached for 24h
- Restricted permissions (700/600) on cache files
- Fallback to direct Vault API if cache miss

scripts/vault_grist_api.sh

@@ -1,55 +1,34 @@
 #!/bin/bash
-# Generic Grist API wrapper using Vault for token retrieval
-# Usage: bash vault_grist_api.sh <METHOD> <API_PATH> [optional: JSON_PAYLOAD_FILE]
-# Example: bash vault_grist_api.sh GET /api/docs/wmBGUbgBveCdeY8fZ6T6eL/tables/Intune/records
+# vault_grist_api.sh - Grist API wrapper using vault cache
+# Now uses local vault cache for faster access
 
-METHOD="$1"
-API_PATH="$2"
-PAYLOAD_FILE="$3"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/vault-env.sh"
 
-if [ -z "$METHOD" ] || [ -z "$API_PATH" ]; then
-    echo "Usage: bash vault_grist_api.sh <METHOD> <API_PATH> [payload_file]"
-    echo "Example: bash vault_grist_api.sh GET /api/docs/wmBGUbgBveCdeY8fZ6T6eL/tables/Intune/records"
+GRIST_URL="https://grist.beawit.net"
+GRIST_TOKEN=$(vault_grist_token)
+
+if [ -z "$GRIST_TOKEN" ]; then
+    echo "Error: Could not retrieve Grist token from vault cache"
     exit 1
 fi
 
-# Step 1: Authenticate to Vault
-VAULT_AUTH=$(curl -sk -X POST \
-  -d '{"role_id":"75d2dcfb-9c65-7f60-59b4-eee8c7f8dc0e","secret_id":"6202b465-2f25-547c-ec07-f47cfc4dda3e"}' \
-  "https://beavault.beawit.net:8200/v1/auth/approle/login")
+# Function to make Grist API calls
+grist_api() {
+    local method="${1:-GET}"
+    local endpoint="$2"
+    local payload="${3:-}"
+    
+    local curl_cmd="curl -sk -H 'Authorization: Bearer ${GRIST_TOKEN}' -H 'Content-Type: application/json'"
+    
+    if [ "$method" != "GET" ] && [ -n "$payload" ]; then
+        curl_cmd="${curl_cmd} -X ${method} -d '${payload}'"
+    fi
+    
+    eval "${curl_cmd} '${GRIST_URL}${endpoint}'"
+}
 
-VAULT_TOKEN=*** "$VAULT_AUTH" | jq -r '.auth.client_token')
-
-if [ -z "$VAULT_TOKEN" ] || [ "$VAULT_TOKEN" = "null" ]; then
-    echo "Error: Vault authentication failed"
-    exit 1
-fi
-
-# Step 2: Retrieve Grist token from Vault
-GRIST_DATA=$(curl -sk -H "X-Vault-Token: $VAULT_TOKEN" \
-  "https://beavault.beawit.net:8200/v1/kv/data/api/integration/grist")
-
-GRIST_TOKEN=*** "$GRIST_DATA" | jq -r '.data.data.token')
-
-if [ -z "$GRIST_TOKEN" ] || [ "$GRIST_TOKEN" = "null" ]; then
-    echo "Error: Failed to retrieve Grist token from Vault"
-    exit 1
-fi
-
-# Step 3: Make Grist API call
-GRIST_URL="https://grist.beawit.net${API_PATH}"
-
-if [ "$METHOD" = "GET" ]; then
-    curl -sk "$GRIST_URL" \
-      -H "Authorization: Bearer $GRIST_TOKEN" \
-      -H "Content-Type: application/json"
-elif [ "$METHOD" = "PATCH" ] && [ -n "$PAYLOAD_FILE" ]; then
-    curl -sk "$GRIST_URL" \
-      -H "Authorization: Bearer $GRIST_TOKEN" \
-      -H "Content-Type: application/json" \
-      -X PATCH \
-      -d "@$PAYLOAD_FILE"
-else
-    echo "Error: Unsupported method or missing payload file for PATCH"
-    exit 1
-fi
+# Export functions
+export -f grist_api
+export GRIST_URL
+export GRIST_TOKEN