Derive the netbox role's username from its filename

Why:
- The role file named its NetBox user in a netbox_username field that repeated
  the filename stem, and the value (svc-terraform-infra) drifted from the role
  name, so the engine role and the user it mints tokens for could disagree.

How:
- Derive netbox_username from the filename in config.hcl, alongside the role
  name, so the role name and NetBox username are the same value by construction.
- Drop the netbox_username field from the role yaml so nothing in the file
  repeats what the filename already encodes.

config/config.hcl

@@ -260,8 +260,9 @@ locals {
     netbox_secret_backend_role = {
       for file_path, content in local.all_configs :
       trimsuffix(replace(file_path, "netbox_secret_backend_role/", ""), ".yaml") => merge(content, {
-        name    = trimsuffix(basename(file_path), ".yaml")
-        backend = dirname(replace(file_path, "netbox_secret_backend_role/", ""))
+        name            = trimsuffix(basename(file_path), ".yaml")
+        netbox_username = trimsuffix(basename(file_path), ".yaml")
+        backend         = dirname(replace(file_path, "netbox_secret_backend_role/", ""))
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }

config/netbox_secret_backend_role/netbox/terraform-infra.yaml

@@ -1,10 +1,11 @@
-# Role minting ephemeral NetBox tokens for the terraform-infra CI runner.
-# terraform-infra manages NetBox IPAM/devices, so tokens carry write access
-# (write_enabled true). Very short TTLs because a token is minted per plan/apply
-# and revoked when the run's lease ends. Reading netbox/creds/terraform-infra
-# mints a lease-bound token deleted from NetBox on revoke/expiry.
+# Role minting ephemeral NetBox tokens for the terraform-infra CI runner. The
+# filename stem is the engine role name AND the NetBox username (config.hcl
+# derives both), so neither is repeated below. terraform-infra manages NetBox
+# IPAM/devices, so tokens carry write access (write_enabled true). Very short
+# TTLs because a token is minted per plan/apply and revoked when the run's lease
+# ends. Reading netbox/creds/terraform-infra mints a lease-bound token deleted
+# from NetBox on revoke/expiry.
 ---
-netbox_username: svc-terraform-infra
 write_enabled: true
 ttl: 120     # 2m
 max_ttl: 300 # 5m