ci: mint rancher token from the vault rancher engine

Retire the static 90-day admin token in kv/service/terraform/rancher; the
vault rancher engine and the read grant on rancher/creds/ci are live.

- Makefile: vault_env reads TF_VAR_rancher_token from rancher/creds/ci
- README: document the ephemeral 1h credential model

README.md

@@ -28,13 +28,10 @@ make format  # fmt tofu + terragrunt hcl
 
 ### Authentication
 
-The rancher2 provider needs a Rancher admin API token, read from Vault at
-`kv/service/terraform/rancher` (field `token`).
-
-> **Note:** Rancher API tokens have a **90-day maximum** lifetime, so the static
-> token must be rotated. This is intended to move to a dedicated Vault Rancher
-> secrets engine that mints short-lived tokens on demand; when that lands, update
-> the Makefile `vault_env` helper to `vault read` from that engine.
+The rancher2 provider needs a Rancher API token, minted on demand by the Vault
+Rancher secrets engine at `rancher/creds/ci`. The token is ephemeral (1h lease)
+and Vault revokes it in Rancher when the lease expires, so nothing needs
+rotating.
 
 Set `VAULT_ROLEID` for local AppRole auth, or `VAULT_AUTH_METHOD=kubernetes`
 for CI (Woodpecker).