Add Vault-scoped agent kubernetes roles + agents AppRole

Give agentic workloads domain-scoped kubernetes credentials so they stop
needing cluster-admin/root. Adds four least-privilege kubernetes secret
engine roles, an `agents` AppRole (role_id-only, CIDR-bound to the agent
workstation) that can mint them, and a write-capable KV grant for the
kubernetes secrets subtree.

- Add kubernetes_secret_backend_role configs agent-dhcp/dns/certs/storage
  with generated_role_rules scoping each to its operator CRDs + pod/log reads.
- Add creds policies for each role, bound to Ben's cluster-operator ldap
  group (human kubectl use) and the agents AppRole (programmatic use).
- Add the `agents` AppRole: bind_secret_id false, token_bound_cidrs
  10.10.12.200/32, deterministic role_id, 1h/4h TTLs.
- Add kv/kubernetes/agents policy granting the AppRole create/read/update/list
  on the kubernetes KV subtree (no delete).

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml

@@ -0,0 +1,33 @@
+---
+rules:
+  - apiGroups:
+      - "cert-manager.io"
+      - "acme.cert-manager.io"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "secrets"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "delete"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"

resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml

@@ -0,0 +1,26 @@
+---
+rules:
+  - apiGroups:
+      - "kea.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"

resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml

@@ -0,0 +1,26 @@
+---
+rules:
+  - apiGroups:
+      - "bind.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"

resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml

@@ -0,0 +1,23 @@
+---
+rules:
+  - apiGroups:
+      - "ceph.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"