Engine plugin v0.2.0 added a `methods` field to roles, pinning a minted
arrproxy key to a set of HTTP methods so a read-only integration can be
handed a key that cannot write. The provider had no way to express it.
- Add an optional `methods` set attribute to arrstack_secret_backend_role,
validated at plan time against GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS.
- Always write `methods`, since the engine only clears a scope when the key
is present; an unrestricted role reads back as null rather than an empty
set so an omitted config value does not drift.
- Document the attribute in the README and examples, and cover the write
mapping, read-back, and validation in tests.
unkin-agent