gitea: add the gitea token secrets engine (mount, config, teabot roles)

Why: teabot's implementer and reviewer bot users should mint ephemeral,
scoped Gitea tokens on demand instead of holding standing personal access
tokens (Gitea tokens never expire on their own). This registers and mounts
the new vault-plugin-secrets-gitea engine and declares its roles, mirroring
the rancher engine wiring.

Change:
- Register the plugin in the catalog (config/plugins/vault-plugin-secrets-gitea.yaml)
  pinned to the released v0.1.0 binary sha256.
- Add gitea_secret_backend + gitea_secret_backend_role modules and wire them
  through config.hcl, terragrunt.hcl, and vault_cluster variables/main, using
  the giteavaultsecret provider (terraform-unkin registry, v0.1.0).
- Mount the engine at gitea/ against https://git.unkin.net; seeded site-admin
  credentials are read from KV (service/vault/au/syd1/secret_backend/gitea/config).
- Add teabot-implementer (write:repository, write:issue) and teabot-reviewer
  (read:repository, write:issue) roles, ttl 1h / max_ttl 4h.

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

config/config.hcl

@@ -239,5 +239,18 @@ locals {
       })
       if startswith(file_path, "rancher_secret_backend_role/")
     }
+    gitea_secret_backend = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "gitea_secret_backend/")
+    }
+    gitea_secret_backend_role = {
+      for file_path, content in local.all_configs :
+      trimsuffix(replace(file_path, "gitea_secret_backend_role/", ""), ".yaml") => merge(content, {
+        name    = trimsuffix(basename(file_path), ".yaml")
+        backend = dirname(replace(file_path, "gitea_secret_backend_role/", ""))
+      })
+      if startswith(file_path, "gitea_secret_backend_role/")
+    }
   }
 }

config/gitea_secret_backend/gitea.yaml

@@ -0,0 +1,11 @@
+# Mounts the gitea token secrets engine at "gitea" and writes its config.
+# The seeded site-admin credentials are sensitive and read from KV, not stored
+# here:
+#   kv/service/vault/au/syd1/secret_backend/gitea/config
+#   -> keys: admin_username (required), admin_password (required)
+# Populate that KV path with a purpose-built Gitea site-admin bot (2FA disabled)
+# BEFORE applying, then run `vault write -f gitea/config/rotate-root` after the
+# first apply so only Vault holds the admin password.
+description: "Gitea ephemeral scoped access token engine"
+gitea_url: "https://git.unkin.net"
+request_timeout_seconds: 30

config/gitea_secret_backend_role/gitea/teabot-implementer.yaml

@@ -0,0 +1,14 @@
+# Role minting ephemeral tokens for the teabot-implementer bot user.
+# The implementer clones/pushes code and opens pull requests, so it gets write
+# on repositories (clone + push + PR create) and write on issues (PR/issue
+# comments). Read is implied by write. No admin/org/user-write scopes.
+# Reading gitea/creds/teabot-implementer mints a lease-bound token deleted from
+# Gitea on revoke/expiry.
+---
+username: teabot-implementer
+scopes:
+  - write:repository
+  - write:issue
+token_name_prefix: vault-teabot-implementer
+ttl: 3600      # 1h
+max_ttl: 14400 # 4h

config/gitea_secret_backend_role/gitea/teabot-reviewer.yaml

@@ -0,0 +1,14 @@
+# Role minting ephemeral tokens for the teabot-reviewer bot user.
+# The reviewer reads code and posts pull-request reviews/comments, so it gets
+# read on repositories (fetch diffs) and write on issues (PR reviews + issue/PR
+# comments). No repository-write, admin, org, or user scopes.
+# Reading gitea/creds/teabot-reviewer mints a lease-bound token deleted from
+# Gitea on revoke/expiry.
+---
+username: teabot-reviewer
+scopes:
+  - read:repository
+  - write:issue
+token_name_prefix: vault-teabot-reviewer
+ttl: 3600      # 1h
+max_ttl: 14400 # 4h

config/plugins/vault-plugin-secrets-gitea.yaml

@@ -0,0 +1,11 @@
+# config/plugins/vault-plugin-secrets-gitea.yaml
+# Imports (registers) the gitea secrets plugin in the catalog. Filename =
+# catalog name = mount type. The binary is installed on the OpenBao nodes by
+# Puppet (openbao-plugin-secrets-gitea RPM ->
+# /opt/openbao-plugins/vault-plugin-secrets-gitea).
+#
+# sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
+# upgrade or OpenBao will refuse to launch the plugin.
+type: secret
+command: vault-plugin-secrets-gitea
+sha256: "8f67fbc216effada5fd7399888a710b62fad83be0b31761a439e7dec3d56509b"