Merge Bruno v4 into RestWolf, and rework the vault integration

[AustralianRaven]

Summary

• Merges 490 upstream commits from usebruno/bruno main (past the v4.0.0 tag) into RestWolf, resolving 44 conflicting files while keeping every fork feature working: Azure Vault, saved and per-environment auth modes, tab retention, custom accent colour, RestWolf branding, the auto-updater and release pipeline, and the PostHog removal.
• Wires up Bruno's git engine, which upstream ships but never registers. Adds a Git UI tab and a toolbar branch chip covering status, stage/unstage, discard, commit, diffs, fetch/pull/push, sync and branch switching.
• Replaces the single enable-and-configure Azure vault with a Secrets Manager section in Preferences, plus an ordered list of vault secrets per environment mirroring the vault-teller tier layout (tenant, cluster, global) with first-match-wins precedence.
• Moves the accent colour picker out of the environment panels and the Themes pane into the Appearance dropdown, fixing a regression where the environment screens edited the app accent.
• Restores upstream code an earlier squash-sync had silently rolled back, and bumps RestWolf to 4.0.0.

Changed files

packages/bruno-electron/src/ipc/git.js
Registers the git operations upstream leaves unreachable: status, init, stage, unstage, discard, commit, file diff, fetch, pull, push and checkout. Every mutating handler returns the recomputed panel state so the renderer never has to re-query. Also works around two quirks in the existing utils — pullGitChanges rejects without an explicit merge strategy, and getUnstagedFileDiff matches absolute paths while git status reports repo-relative ones.

packages/bruno-app/src/hooks/useGitStatus/index.js
Shared git state for a collection, used by both the Git UI tab and the toolbar chip so an action in one updates the other. Each operation reports through a toast, because git succeeds silently and a working push was otherwise indistinguishable from a broken button. sync() pulls before pushing so a diverged branch does not hit a non-fast-forward rejection.

packages/bruno-app/src/components/Git/GitUI/
The Git UI tab: a sidebar with the commit box and changed-file list, and a main pane with sync, fetch, pull, push, ahead/behind counts and a branch switcher. Selecting a file swaps the pane for a coloured diff. A checkout that would overwrite local edits is left to fail so git's own message surfaces, rather than being forced or auto-stashed.

packages/bruno-app/src/components/Git/GitBranchChip/
Branch chip in the collection toolbar showing the current branch and ahead/behind drift, rendered only for collections that sit inside a git repository. Clicking it opens the Git UI tab.

packages/bruno-electron/src/store/secret-managers.js
New encrypted store for external secret providers. Credentials previously sat in plain text in preferences.json; the client secret is now encrypted at rest through the existing safeStorage-backed helpers and never leaves the main process. Provider order is meaningful — it is the precedence used when a secret could come from more than one vault.

packages/bruno-electron/src/ipc/secret-managers.js
CRUD, connection testing and resolution for secret providers. Resolution walks an ordered list of {vaultName, secretName} refs, first match winning per key, and records what each tier shadowed so a lower tier does not look silently ignored. A pinned vault is honoured or reported rather than falling back to another provider, which would otherwise return a different environment's values under the same key names.

packages/bruno-app/src/components/Preferences/SecretsManager/
Preferences pane for adding, editing, reordering and removing providers, with a Test Connection action. The client secret field stays blank when editing and only overwrites the stored value when a replacement is typed.

packages/bruno-app/src/components/Environments/VaultSecrets/
The environment Secrets panel. Holds the ordered secret list, each row pinned to a provider or left as "any vault", and after fetching offers a source dropdown to switch between the merged view and any single tier. Keys claimed by a higher tier are struck through and labelled with the winner. Apply pushes the merged set into the environment; Clear removes the secret rows, since Reset only reverts to the saved state and is no help once they have been saved.

packages/bruno-app/src/components/WorkspaceHome/WorkspaceEnvironments/EnvironmentList/EnvironmentDetails/EnvironmentVariables/index.js
Rewritten around the ordered secret refs. The list persists as a single VAULT_SECRETS variable of <vault>:<secret> entries so it travels with the collection in git; the previous VAULT_SECRET is still read. The panel is a sibling of the table inside a scrolling column, because neither the environment content area nor the table wrapper scrolls, and an unbounded panel pushed the table's Save button out of reach.

packages/bruno-app/src/components/EnvironmentVariablesTable/index.js
Handles the bulk apply and bulk clear events from the vault panel. Values arriving from a vault are now all marked secret rather than guessed at by name, so they land on the Secrets tab and are masked. The old inline vault row and its styles are removed.

packages/bruno-app/src/components/Preferences/General/index.js
Drops the Azure vault section, its Yup schema and its save payload, superseded by the Secrets Manager pane.

packages/bruno-electron/src/ipc/azure-vault.js
Deleted. Its single-vault fetch is replaced by the provider-aware resolver; services/azure-vault.js remains as the Azure client.

packages/bruno-app/src/components/StatusBar/ThemeDropdown/
Hosts the accent colour picker, editing the accent for whichever theme is currently displayed. The menu's fixed height became a minimum so the new row does not spill out over the status bar, and the swatch's own dropdown opens upward since the menu is anchored to the bottom of the window.

packages/bruno-app/src/components/Preferences/Themes/index.js and packages/bruno-app/src/components/Environments/EnvironmentSettings/EnvironmentList/EnvironmentDetails/index.js
Remove the accent picker. The fork had repurposed ColorPicker to take value/label/onReset, so upstream's per-environment call sites — which pass a color prop it no longer reads — were rendering the accent picker and editing the app accent.

packages/bruno-app/src/components/Preferences/index.js
Registers the Secrets Manager tab.

packages/bruno-app/src/providers/ReduxStore/slices/tabs.js, packages/bruno-app/src/components/RequestTabs/RequestTab/SpecialTab.js, packages/bruno-app/src/components/RequestTabs/RequestTab/index.js, packages/bruno-app/src/components/RequestTabPanel/index.js, packages/bruno-app/src/components/RequestTabs/CollectionHeader/index.js
Register git-ui as a non-replaceable tab type, give it an icon and label, render the panel for that tab, and place the branch chip in the collection toolbar.

packages/bruno-lang/v2/src/envToJson.js, packages/bruno-lang/v2/src/jsonToEnv.js
Conflict resolution on the environment grammar: the fork's meta block and upstream's externalsecrets block now both parse and serialise instead of one replacing the other.

packages/bruno-filestore/src/formats/yml/parseEnvironment.ts, packages/bruno-filestore/src/formats/yml/stringifyEnvironment.ts
Environment auth (fork) and externalSecrets (upstream) both round-trip through the yml format.

packages/bruno-schema/src/collections/index.js
Environment schema carries both auth and externalSecrets, and the auth mode enum unions the fork's inherit-environment and named with upstream's akamai-edgegrid. Without this the save path rejects the merged shape.

packages/bruno-app/src/components/Sidebar/CreateCollection/index.js, packages/bruno-app/src/components/WorkspaceSidebar/CreateWorkspace/index.js, packages/bruno-app/src/components/RequestTabs/ExampleTab/index.js, packages/bruno-app/src/components/Sidebar/Collections/Collection/CollectionItem/ExampleItem/index.js
Restore upstream behaviour the earlier squash-sync had rolled back: name trimming and validation messages on create, and the exampleIndex plumbing that keeps a response example distinct from its request.

packages/bruno-converters/src/insomnia/insomnia-to-bruno.js
Restores handling for an empty mime type with a text body, covered by the Insomnia specs restored alongside it.

packages/bruno-electron/src/index.js
Swaps the Azure vault IPC registration for the secret manager one, and keeps the fork's auto-updater init alongside upstream's new mock-server, AI, mount and sqlite registrations.

packages/bruno-electron/package.json
Bumps RestWolf to 4.0.0. This is the only file carrying the app version — electron-builder reads it for artifact names and scripts/release.js bumps it from there.

Restored test files — tests/snapshots/request-pane-interactivity.spec.ts, tests/collection/create/create-collection.spec.ts, tests/workspace/create-workspace/create-workspace.spec.ts, packages/bruno-converters/tests/insomnia/insomnia-collection.spec.js, packages/bruno-converters/tests/insomnia/insomnia-collection-v5.spec.js
Upstream specs the fork had deleted, restored so the behaviours above stay covered. Two of the regressions listed here were caught by these tests once they were back in place.