policies: let terraform-git seed the gitea engine admin credential to KV

Why: terraform-git now provisions the gitea-vault-admin site-admin bot and
writes its generated password to kv/service/vault/au/syd1/secret_backend/gitea/config
so the gitea secrets engine can consume it at creation time. The
woodpecker_terraform_git / terraform_git identity has no write access to that
KV path, so its apply would 403 without this grant. The deployer that reads the
seed already has read via policies/kv/service/vault/secret_backends_read.yaml.

Change:
- Add policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
  granting create/read/update on the gitea config KV path to the terraform_git
  approle and woodpecker_terraform_git k8s role.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml

@@ -0,0 +1,20 @@
+# Allow terraform-git to seed (write once) the gitea secrets engine's admin
+# credentials. terraform-git creates the gitea-vault-admin site-admin bot and
+# writes its generated password here as admin_username + admin_password; the
+# vault gitea engine (managed by the tf_vault deployer) reads it at gitea/config
+# creation time. Read is already granted to the deployer via
+# policies/kv/service/vault/secret_backends_read.yaml, so this only adds the
+# write side for terraform-git's own identity.
+---
+rules:
+  - path: "kv/data/service/vault/au/syd1/secret_backend/gitea/config"
+    capabilities:
+      - create
+      - read
+      - update
+
+auth:
+  approle:
+    - terraform_git
+  k8s/au/syd1:
+    - woodpecker_terraform_git