feat(vault): add get_tfa_code (email + authenticator)

[suislanchezcc]

Summary

Adds VaultClient.get_tfa_code(permissioned_user_id, domain) to the Python SDK, mirroring the new cloudcruise-js method (PR #12) and wrapping the backend endpoint GET /vault/tfa-code (monorepo PR #7017, merged + verified on staging).

Usage

tfa = client.vault.get_tfa_code("user123", "https://example.com")
# authenticator -> VaultTfaCode(type="authenticator", code="123456", expires_in_seconds=23)
# email         -> VaultTfaCode(type="email", code="884512", received_at="...")

Behavior (auto-detected by the credential's tfa_method)

• Authenticator (TOTP): freshly generated code; expires_in_seconds set.
• Email: most-recently-received code within the freshness window; received_at set.
• SMS / magic link: not supported — the endpoint returns 409.

Changes

• cloudcruise/vault/client.py — get_tfa_code method (validates params, GETs /vault/tfa-code, maps to VaultTfaCode, drops unknown fields for forward-compat).
• cloudcruise/vault/types.py — VaultTfaCode dataclass.
• cloudcruise/vault/__init__.py + cloudcruise/__init__.py — module-level get_tfa_code convenience + VaultTfaCode export.
• cloudcruise/vault/README.md — usage example.

Notes

• Depends on the backend endpoint (monorepo PR #7017, already merged/deployed to staging).
• ruff clean on the changed files; functional test confirms the request path, response mapping, and param validation. (Pre-existing ruff/mypy findings in unrelated files are untouched.)

[greptile-apps]

Greptile Summary

This PR adds a vault helper for retrieving current 2FA codes. It changes:

• Adds VaultClient.get_tfa_code(permissioned_user_id, domain) for GET /vault/tfa-code.
• Adds the VaultTfaCode dataclass for authenticator and email code responses.
• Exports VaultTfaCode and get_tfa_code through the vault package APIs.
• Documents basic usage for authenticator and email 2FA codes.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

_{Reviews (3): Last reviewed commit: "fix(vault): redact code in VaultTfaCode ..." | Re-trigger Greptile}