feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret

The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is
now registered in Vault, but nothing declared its mount/config or roles in
this repo. Wire in the companion litellm provider so the mount is managed
as code alongside the other secret backends.

- Add litellm_secret_backend module: mounts the engine and writes its
  config (base_url, request_timeout_seconds); reads master_key from KV
- Add litellm_secret_backend_role module: manages roles (models,
  max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata)
- Register both modules in vault_cluster main.tf and variables.tf
- Discover litellm_secret_backend[_role] YAML in config.hcl and pass them
  through terragrunt inputs
- Declare the litellm provider (litellmvaultsecret) and
  a provider block in the generated root backend.tf
- Add example config for the litellm mount and a sample role

config/config.hcl

@@ -185,5 +185,18 @@ locals {
       trimsuffix(basename(file_path), ".yaml") => content
       if startswith(file_path, "pki_mount_only/")
     }
+    litellm_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "litellm_secret_backend/")
+    }
+    litellm_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "litellm_secret_backend_role/")
+    }
   }
 }

config/litellm_secret_backend/litellm.yaml

@@ -0,0 +1,6 @@
+# Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
+# The master key is sensitive and read from KV, not stored here:
+#   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
+description: "LiteLLM dynamic virtual keys"
+base_url: "http://litellm.litellm.svc:4000"
+request_timeout_seconds: 30

config/litellm_secret_backend_role/litellm/rspamd.yaml

@@ -0,0 +1,10 @@
+---
+models:
+  - claude-haiku-4-5
+  - claude-sonnet-4-6
+max_budget: 50
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: mailfiltering
+  env: prod