Grant terraform-infra kv metadata read

vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
metadata path on every plan/apply; add read on kv/metadata/service/terraform/infra
so the plan doesn't 403 (same pattern as the terraform-git gitea config policy).

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

policies/kv/service/terraform/infra.yaml

@@ -5,6 +5,11 @@ rules:
   - path: "kv/data/service/terraform/infra"
     capabilities:
       - read
+  # vault_kv_secret_v2 (providers.tf data source) reads the kv-v2 metadata path
+  # on every plan/apply; a 403 here fails the plan.
+  - path: "kv/metadata/service/terraform/infra"
+    capabilities:
+      - read
 
 auth:
   approle: