Summary

• Adds rwx vaults oidc-tokens create command with --vault (required), --name, --audience, and --provider flags
• Provider resolution is fully delegated to the API — the CLI passes --provider through and lets the server handle defaults and validation
• Client-side validation only ensures --name and --audience are present when --provider is not given
• Handles both {"error": "..."} and {"errors": [...]} response formats from the API
• Supports --output json for structured output

Test plan

• 7 unit tests covering: explicit name+audience, provider passthrough, provider with overrides, missing name/audience validation, API error propagation, JSON output
• End-to-end verification against the API