Infer NetBox user from the engine role config

Why:
- The NetBox service identity was split across two files (config/netbox_user
  and config/netbox_secret_backend_role) that repeated the username three
  times: the filename, a netbox_username field, and the permission name.
- Creating the engine role and creating its NetBox user are one act, so one
  file should describe the whole identity.

How:
- Make config/netbox_secret_backend_role/netbox/<name>.yaml the single source
  per identity: filename = engine role name = NetBox username, body = write
  access, TTLs, and an inline permissions block.
- Derive netbox_username from the filename in config.hcl (keep netbox_user_id
  as an optional override), and drop the netbox_username field from the role
  yaml.
- Iterate that same role map in the netbox_user_management module, keyed by
  config path, to synthesize the NetBox user and object permissions; default a
  single permission's name to the role name so nothing repeats the filename.
- Delete the config/netbox_user tree and its netbox_user variable/wiring.
- Scope terraform-infra to view/add/change/delete on the IPAM/DCIM objects it
  manages: prefixes, ip-addresses, ip-ranges, devices, interfaces, mac
  addresses.

config/config.hcl

@@ -260,15 +260,11 @@ locals {
     netbox_secret_backend_role = {
       for file_path, content in local.all_configs :
       trimsuffix(replace(file_path, "netbox_secret_backend_role/", ""), ".yaml") => merge(content, {
-        name    = trimsuffix(basename(file_path), ".yaml")
-        backend = dirname(replace(file_path, "netbox_secret_backend_role/", ""))
+        name            = trimsuffix(basename(file_path), ".yaml")
+        netbox_username = trimsuffix(basename(file_path), ".yaml")
+        backend         = dirname(replace(file_path, "netbox_secret_backend_role/", ""))
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }
-    netbox_user = {
-      for file_path, content in local.all_configs :
-      trimsuffix(basename(file_path), ".yaml") => content
-      if startswith(file_path, "netbox_user/")
-    }
   }
 }

config/netbox_secret_backend_role/netbox/terraform-infra.yaml

@@ -1,10 +1,25 @@
-# Role minting ephemeral NetBox tokens for the terraform-infra CI runner.
-# terraform-infra manages NetBox IPAM/devices, so tokens carry write access
-# (write_enabled true). Very short TTLs because a token is minted per plan/apply
-# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra
-# mints a lease-bound token deleted from NetBox on revoke/expiry.
+# Single declarative source for the terraform-infra NetBox service identity. The
+# filename stem is the engine role name AND the NetBox username (1:1); config.hcl
+# derives both from it, so neither is repeated below. Creating this file creates
+# the user: the netbox_user_management module synthesizes the NetBox user + object
+# permissions from the permissions block, and the engine role mints ephemeral
+# tokens for that same user. write_enabled true because terraform-infra manages
+# NetBox IPAM/DCIM; very short TTLs because a token is minted per plan/apply and
+# revoked when the run's lease ends.
 ---
-netbox_username: terraform-infra
 write_enabled: true
 ttl: 120     # 2m
 max_ttl: 300 # 5m
+permissions:
+  - object_types:
+      - ipam.prefix
+      - ipam.ipaddress
+      - ipam.iprange
+      - dcim.device
+      - dcim.interface
+      - dcim.macaddress
+    actions:
+      - view
+      - add
+      - change
+      - delete

config/netbox_user/terraform-infra.yaml

@@ -1,31 +0,0 @@
-# Declarative NetBox service identity for the terraform-infra CI runner. The
-# filename stem is the NetBox username and matches the netbox engine role name
-# 1:1 (netbox/roles/terraform-infra mints tokens for this user). Ben seeds only
-# the engine admin token; this user and its permissions are created from here,
-# never by hand. Write access covers the IPAM/DCIM objects terraform-infra
-# manages (prefixes, ip-addresses, ip-ranges, devices, interfaces, mac
-# addresses, plus the supporting role/tag/type objects it also touches).
----
-backend: netbox
-active: true
-staff: false
-permissions:
-  - name: terraform-infra
-    description: terraform-infra IPAM/DCIM write access (tokens minted by Vault)
-    object_types:
-      - ipam.prefix
-      - ipam.ipaddress
-      - ipam.iprange
-      - ipam.role
-      - dcim.device
-      - dcim.interface
-      - dcim.macaddress
-      - dcim.manufacturer
-      - dcim.devicetype
-      - dcim.devicerole
-      - extras.tag
-    actions:
-      - view
-      - add
-      - change
-      - delete