Grant terraform-infra kv metadata read (#113)

Follow-up to the merged #111 (which shipped `kv/data/service/terraform/infra` read only).

`terraform-infra`'s providers.tf uses a `vault_kv_secret_v2` **data source**, which reads the kv-v2 **metadata** path on every plan/apply (same behaviour that 403'd a prior terraform-git apply — see `policies/kv/service/vault/.../gitea/config_write.yaml`). Add `kv/metadata/service/terraform/infra` read so the plan doesn't 403 once the secret is seeded.

Verified against terraform-infra PR #5: `skip_child_token` cleared the child-token 403 and the data-read policy works (plan now reaches "no secret found"); metadata read is the remaining policy gap before a seeded plan can pass.

https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
Reviewed-on: #113
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

policies/kv/service/terraform/infra.yaml

@@ -5,6 +5,11 @@ rules:
   - path: "kv/data/service/terraform/infra"
     capabilities:
       - read
+  # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
+  # metadata path on every plan/apply; a 403 here fails the plan.
+  - path: "kv/metadata/service/terraform/infra"
+    capabilities:
+      - read
 
 auth:
   approle: