Fix vault provider auth in CI: skip_child_token + correct kv path

The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create
403), which failed the plan's vault_kv_secret_v2 read. Set skip_child_token so the
provider uses the login token directly (estate pattern). Also correct the KV path
missed in the ipam->infra rename: service/terraform/infra.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

modules/infra/providers.tf

@@ -1,12 +1,15 @@
 provider "vault" {
   address = var.vault_address
+  # The woodpecker_terraform_infra role cannot mint child tokens (auth/token/create
+  # is denied); use the login token directly.
+  skip_child_token = true
 }
 
 # KeaAPI and NetBox tokens live in a single Vault KV v2 secret. The vault
 # provider authenticates with the VAULT_TOKEN set by the Makefile.
 data "vault_kv_secret_v2" "tokens" {
   mount = "kv"
-  name  = "service/terraform/ipam"
+  name  = "service/terraform/infra"
 }
 
 provider "netbox" {