Drop admin policy + puppet-facts role from netbox engine

Why:
- The netbox admin policy now lands first in its own PR, and puppet-facts is
  deferred until puppet-host Vault auth is solved (issue #518), so neither
  belongs in this engine PR.

How:
- Remove policies/netbox/admin.yaml (moved to the admin-policy PR).
- Remove the puppet-facts role config; keep only the terraform-infra role.
- Shorten the terraform-infra role to ttl 120s / max_ttl 300s to match its
  per-run mint-and-revoke lifecycle.

config/netbox_secret_backend_role/netbox/puppet-facts.yaml

@@ -1,16 +0,0 @@
-# Role minting ephemeral read-only NetBox tokens for the puppet netbox fact.
-# The fact (profiles::netbox::facts) only GETs this node's device/VM + interface
-# data, so tokens are read-only (write_enabled false). Longer TTLs than the
-# terraform-infra role because the token feeds a persistent, cache-backed fact.
-# Reading netbox/creds/puppet-facts mints a lease-bound token deleted from
-# NetBox on revoke/expiry.
-#
-# There is no puppet-host -> Vault auth in the estate, so no consumer policy
-# binds netbox/creds/puppet-facts: an operator mints from this role by hand and
-# seeds the token into hieradata (profiles::netbox::facts::api_token). See the
-# PR body for the flagged design choice.
----
-netbox_username: svc-puppet-facts
-write_enabled: false
-ttl: 86400     # 24h
-max_ttl: 259200 # 72h

config/netbox_secret_backend_role/netbox/terraform-infra.yaml

@@ -1,10 +1,10 @@
 # Role minting ephemeral NetBox tokens for the terraform-infra CI runner.
 # terraform-infra manages NetBox IPAM/devices, so tokens carry write access
-# (write_enabled true). Short TTLs because a token is minted per plan/apply and
-# revoked when the run's lease ends. Reading netbox/creds/terraform-infra mints
-# a lease-bound token deleted from NetBox on revoke/expiry.
+# (write_enabled true). Very short TTLs because a token is minted per plan/apply
+# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra
+# mints a lease-bound token deleted from NetBox on revoke/expiry.
 ---
 netbox_username: svc-terraform-infra
 write_enabled: true
-ttl: 3600      # 1h
-max_ttl: 14400 # 4h
+ttl: 120     # 2m
+max_ttl: 300 # 5m