Add terraform-enc Vault/Consul plumbing + encapi token grant (#98)

The new **terragrunt-enc** repo manages all encapi ENC data (statuses, roles, node classifications) via Terraform/Terragrunt and needs its own Vault/Consul plumbing, mirroring terraform-git and terraform-incus. This supersedes the dual-write approach in terraform-incus PR #39; the equivalent terraform-incus grant (PR #97) is being closed, so the encapi-token grant is created fresh here for the new approle.

Changes:
- Add approle role `terraform_enc` and k8s auth role `woodpecker_terraform_enc` (bound to the `terraform-enc` ServiceAccount in the `woodpecker` namespace) for CI auth.
- Add consul secret backend role `terraform-enc` plus its ACL rules granting `write` on `infra/terraform/enc/` (its terragrunt state prefix), and a policy letting both auth roles read `consul_root/au/syd1/creds/terraform-enc`.
- Grant both auth roles read on `kv/data/kubernetes/namespace/encapi/default/environment` (the ENCAPI_WRITE_TOKEN) so `make apply` can write to encapi via the encapi provider.

Reviewed-on: #98
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

policies/kv/service/terraform/enc-encapi-environment.yaml

@@ -0,0 +1,14 @@
+# Allow the terragrunt-enc runner to read the encapi environment secret
+# (ENCAPI_WRITE_TOKEN), so `make apply` can write ENC data (statuses, roles,
+# nodes) to encapi via the encapi Terraform provider.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/encapi/default/environment"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_enc
+  k8s/au/syd1:
+    - woodpecker_terraform_enc