feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret

The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is
now registered in Vault, but nothing declared its mount/config or roles in
this repo. Wire in the companion litellm provider so the mount is managed
as code alongside the other secret backends.

- Add litellm_secret_backend module: mounts the engine and writes its
  config (base_url, request_timeout_seconds); reads master_key from KV
- Add litellm_secret_backend_role module: manages roles (models,
  max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata)
- Register both modules in vault_cluster main.tf and variables.tf
- Discover litellm_secret_backend[_role] YAML in config.hcl and pass them
  through terragrunt inputs
- Declare the litellm provider (git.unkin.net/unkin/litellmvaultsecret) and
  a provider block in the generated root backend.tf
- Add example config for the litellm mount and a sample role

environments/au/syd1/terragrunt.hcl

@@ -68,6 +68,8 @@ inputs = {
   kubernetes_secret_backend      = local.config.kubernetes_secret_backend
   kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
   pki_mount_only                 = local.config.pki_mount_only
+  litellm_secret_backend         = local.config.litellm_secret_backend
+  litellm_secret_backend_role    = local.config.litellm_secret_backend_role
 
   # Pass policy maps to vault_cluster module
   policy_auth_map  = local.policies.policy_auth_map

environments/root.hcl

@@ -11,6 +11,12 @@ provider "vault" {
   address = local.vault_addr
 }
 
+# The LiteLLM secrets engine is managed through its own provider, which talks to
+# the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
+provider "litellm" {
+  address = local.vault_addr
+}
+
 terraform {
   backend "consul" {
     address = "https://consul.service.consul"
@@ -29,6 +35,10 @@ terraform {
       source  = "hashicorp/consul"
       version = "2.23.0"
     }
+    litellm = {
+      source  = "git.unkin.net/unkin/litellmvaultsecret"
+      version = "0.1.0"
+    }
   }
 }
 EOF