feat: scaffold nani CLI + MCP server

Single Rust binary with three modes:
- Human CLI with colored output
- M2M mode (--json, --plain, --silent flags)
- MCP server over stdio (nani mcp-server)

HTTP client for config.saiden.dev REST API:
- Projects: list, set metadata, delete
- Secrets: get, set, list, delete
- Files: get, put, list, delete

Global flags: --json, --plain, --silent, --dry-run, --url, --api-key
Config: ~/.config/nani/config.json + NANI_API_KEY/NANI_URL env vars

MCP tools: nani_get, nani_set, nani_list, nani_delete, nani_file_get, nani_file_put

Dependencies: clap (derive), reqwest (rustls-tls), serde, tokio, rmcp, colored

Closes infra/nani#1

README.md

@@ -1,3 +1,65 @@
 # nani
 
-Secrets, config, and file store — Rust CLI, M2M, and MCP server for config.saiden.dev
+CLI and MCP server for [config.saiden.dev](https://config.saiden.dev) — secrets, config, and file management.
+
+## Install
+
+```bash
+cargo install --path .
+```
+
+## Auth
+
+```bash
+nani auth <api-key>         # store key to ~/.config/nani/config.json
+nani auth show              # show current config (masked key)
+```
+
+Or set `NANI_API_KEY` environment variable.
+
+## Usage
+
+```bash
+# Projects
+nani ls                                     # list all projects
+nani projects set <project> --gitea <url>   # set project metadata
+nani projects rm <project>                  # delete project
+
+# Secrets
+nani ls <project> <env>                     # list keys
+nani get <project> <env> <key>              # get secret
+nani set <project> <env> <key> <value>      # set secret
+nani set <project> <env> <key> -f <file>    # set from file
+nani rm <project> <env> <key>               # delete secret
+
+# Files
+nani files ls <project> <env>               # list files
+nani files get <project> <env> <path>       # download file
+nani files put <project> <env> <path> -f <file>  # upload file
+nani files rm <project> <env> <path>        # delete file
+```
+
+## Global flags
+
+| Flag | Description |
+|------|-------------|
+| `--json` | Structured JSON output (M2M mode) |
+| `--plain` | Raw value only, no decoration (for piping) |
+| `--silent` | No stdout, exit code only (0=ok, 1=error, 2=not-found) |
+| `--dry-run` | Show HTTP request without executing |
+| `--url <base>` | Override base URL |
+| `--api-key <key>` | Override API key (one-shot) |
+
+## MCP Server
+
+```bash
+nani mcp-server
+```
+
+Exposes tools over stdio JSON-RPC: `nani_get`, `nani_set`, `nani_list`, `nani_delete`, `nani_file_get`, `nani_file_put`.
+
+## Config
+
+- File: `~/.config/nani/config.json`
+- `NANI_API_KEY` env var overrides config file
+- `NANI_URL` env var overrides base URL