vctx: colourise json/yaml output with --color

docs/vctx.md

@@ -8,7 +8,7 @@ invocation only, and execs `vault` with the remaining arguments.
 ## Synopsis
 
 ```
-vctx --context <context> [--format <fmt>] <any vault args...>
+vctx --context <context> [--format <fmt>] [--color auto|always|never] <any vault args...>
 vctx version
 ```
 
@@ -30,7 +30,8 @@ vctx --context sydney kv put kv/foo/bar secret=baz
      [Output format](#output-format))
 4. `exec`s the `vault` binary (found on `PATH`) with everything after the
    context. Because it replaces the process, `vault`'s exit status, signals and
-   TTY behaviour pass straight through.
+   TTY behaviour pass straight through (json/yaml output on a terminal is
+   instead run as a child and colourised; see [Colour](#colour)).
 
 The ambient `VAULT_ADDR` / `VAULT_TOKEN` / `VAULT_NAMESPACE` in your shell are ignored for the call
 — `vctx` always targets the chosen context.
@@ -50,9 +51,32 @@ It is left alone when `VAULT_FORMAT` is already set in the environment or the
 vault args include `-format` or `-field`. `--format` (`table`, `json`, `yaml`,
 `pretty`; `raw` for `vault read` only) always sets it, overriding the environment.
 
+## Colour
+
+When the effective format is `json` or `yaml` (from the table above,
+`--format`, a `-format` vault arg, or `VAULT_FORMAT`), `vctx` colourises vault's
+output like `jq`/`yq`. To do so it runs `vault` as a child instead of exec'ing
+it: stdin and stderr pass straight through, stdout is buffered and re-emitted
+coloured, SIGINT/SIGTERM are forwarded, and vault's exit code is returned
+(`128+n` if killed by signal `n`).
+
+`--color` controls this:
+
+| Value    | Behaviour |
+|----------|-----------|
+| `auto`   | colour only when stdout is a terminal, `NO_COLOR` is unset/empty and `TERM` is not `dumb` (default) |
+| `always` | always colour |
+| `never`  | never colour |
+
+Without colour (piped output, `NO_COLOR`, `table`/`raw`/`pretty` formats)
+`vctx` execs `vault` exactly as before, so scripts see unchanged output.
+Streaming or interactive commands (`monitor`, `debug`, `events`, `ssh`,
+`agent`, `proxy`, `server`) are always exec'd and never coloured. `JQ_COLORS`
+overrides the JSON palette as in `jq`.
+
 ## Flags
 
-`--context` and `--format` are the only flags `vctx` consumes; they must come
+`--context`, `--format` and `--color` are the only flags `vctx` consumes; they must come
 **before** the vault command. Everything from the first non-flag argument onward is handed to `vault`
 untouched, so vault's own flags work normally: