Mount the rancher secrets engine + seed a service account + roles (#93)

## Why

Deploy the new Rancher token secrets engine into the cluster (the last of the 4 wiring PRs), mirroring the litellm/gpg pattern. Users can then `vault read rancher/creds/<role>` for short-lived, cluster-scoped Rancher tokens, backed by a seeded admin token the engine auto-rotates before Rancher's 90-day cap.

## Changes

- Add `rancher_secret_backend` module — mount + config via the ranchervaultsecret provider (rancher_url `https://rancher.k8s.syd1.au.unkin.net`).
- Add `rancher_secret_backend_service_account` module — seeds an auto-rotated token (90d TTL / 45d rotation); the seed token is read from KV, not git.
- Add `rancher_secret_backend_role` module + a `ci` role (1h/8h, cluster+TTL scoped).
- Wire `config.hcl` discovery, module variables, `main.tf` blocks, terragrunt inputs, and the `rancher` provider in `root.hcl`.
- Config: `config/rancher_secret_backend/rancher.yaml`, `.../service_account/rancher/admin.yaml`, `.../role/rancher/ci.yaml`.

## Prerequisite

Populate `kv/service/vault/au/syd1/secret_backend/rancher/service_account/admin` with a live Rancher admin token (keys: `token`, optional `token_name`) **before** apply, exactly as litellm's `master_key` is seeded in KV.

## Merge order

Part 4 of 4 (last). Requires: puppet install (#483) → deployer policy (#91) → plugin import (#92) → this. The `plan` needs the KV seed present, so seed KV first.

---------

Co-authored-by: Ben Vincent <neotheo@gmail.com>
Reviewed-on: #93
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

modules/vault_cluster/variables.tf

@@ -350,6 +350,44 @@ variable "gpg_key" {
   default = {}
 }
 
+variable "rancher_secret_backend" {
+  description = "Map of rancher token secret engines to create (mount + config)"
+  type = map(object({
+    plugin                  = optional(string, "vault-plugin-secrets-rancher")
+    description             = optional(string)
+    rancher_url             = string
+    ca_cert                 = optional(string)
+    tls_skip_verify         = optional(bool, false)
+    request_timeout_seconds = optional(number, 30)
+  }))
+  default = {}
+}
+
+variable "rancher_secret_backend_service_account" {
+  description = "Map of seeded, auto-rotated rancher service-account tokens (seed token read from KV)"
+  type = map(object({
+    name            = string
+    backend         = string
+    token_ttl       = optional(number)
+    rotation_period = optional(number)
+  }))
+  default = {}
+}
+
+variable "rancher_secret_backend_role" {
+  description = "Map of rancher token-minting roles to create"
+  type = map(object({
+    name            = string
+    backend         = string
+    service_account = string
+    cluster_name    = optional(string)
+    description     = optional(string)
+    ttl             = optional(number)
+    max_ttl         = optional(number)
+  }))
+  default = {}
+}
+
 variable "policy_auth_map" {
   description = "Map of auth mounts -> auth roles -> policy names"
   type        = map(map(list(string)))