vault: add arrstack policies (deployer + KV read + creds) (2/3) (#126)

## Why

Grants the Vault access the arrstack engine needs, before any engine resources exist. **PR 2 of 3 (policy)**, stacked on #125 (register). Keeping policy separate from resources honours the never-bundle / sequential-apply rule.

## Change

- Adds `policies/arrstack/admin.yaml`: the terraform-vault deployer (`tf_vault` approle + `woodpecker_terraform_vault` k8s role) may create/read/update/delete `arrstack/config` and manage `arrstack/roles/*`.
- Adds `policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml`: the deployer may read the KV-seeded arrproxy admin token (both `kv/data/...` and `kv/metadata/...`) that the engine config sources. The existing `secret_backends_read` policy does not cover this `kubernetes/namespace` KV path.
- Adds `policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml`: each `terraform-<app>` run may read its own `arrstack/creds/<app>` to mint a scoped key.
- Policy YAMLs are auto-discovered by `policies/policies.hcl`, so no wiring changes are needed.

## Apply order

Apply **after PR #125 (register)**. Safe to apply before the engine exists — these only grant capabilities on paths.

## Stack

1. register -> #125
2. **policy (this PR)** -> `benvin/arrstack-policy` off `benvin/arrstack-register`
3. resources -> `benvin/arrstack-resources`

Supersedes #124.

Reviewed-on: #126
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

policies/arrstack/admin.yaml

@@ -0,0 +1,27 @@
+# Allow management of the arrstack secrets engine (config and roles) by the
+# terraform-vault deployer.
+---
+rules:
+  - path: "arrstack/config"
+    capabilities:
+      - create
+      - update
+      - read
+      - delete
+  - path: "arrstack/roles/*"
+    capabilities:
+      - create
+      - update
+      - delete
+      - read
+      - list
+  - path: "arrstack/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault

policies/arrstack/creds/prowlarr.yaml

@@ -0,0 +1,12 @@
+# Allow the terraform-prowlarr run to mint a Prowlarr-scoped arrproxy key.
+---
+rules:
+  - path: "arrstack/creds/prowlarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_prowlarr
+  k8s/au/syd1:
+    - woodpecker_terraform_prowlarr

policies/arrstack/creds/radarr.yaml

@@ -0,0 +1,12 @@
+# Allow the terraform-radarr run to mint a Radarr-scoped arrproxy key.
+---
+rules:
+  - path: "arrstack/creds/radarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_radarr
+  k8s/au/syd1:
+    - woodpecker_terraform_radarr

policies/arrstack/creds/sonarr.yaml

@@ -0,0 +1,12 @@
+# Allow the terraform-sonarr run to mint a Sonarr-scoped arrproxy key.
+---
+rules:
+  - path: "arrstack/creds/sonarr"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - terraform_sonarr
+  k8s/au/syd1:
+    - woodpecker_terraform_sonarr

policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml

@@ -0,0 +1,22 @@
+# Allow the terraform-vault deployer to read the seeded arrproxy admin token so
+# the arrstack engine config module can source it. The token is seeded by
+# argocd-apps #384 at kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token.
+# The deployer's existing secret_backends_read policy only covers
+# kv/data/service/vault/+/+/secret_backend/*, which does not match this
+# kubernetes/namespace path, so this adds the minimal read grant rather than
+# duplicating the secret into the litellm-style path. vault_kv_secret_v2 also
+# reads the kv-v2 metadata path on every plan/apply, so grant that too.
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/arrstack/default/arrproxy-admin-token"
+    capabilities:
+      - read
+  - path: "kv/metadata/kubernetes/namespace/arrstack/default/arrproxy-admin-token"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault