Manage NetBox service users declaratively for the netbox engine

Why:
- The netbox secrets engine can only mint tokens for NetBox users that already
  exist, so today those service users must be hand-created before a role works.
  Consul already solves the equivalent problem declaratively, and NetBox should
  be managed the same way so Ben seeds only the engine admin token.

How:
- Add a netbox_user_management module mirroring consul_acl_management: it reads
  each backend's seeded admin token from KV, configures one e-breuninger/netbox
  provider per backend, and creates netbox_user + netbox_permission resources
  from a config-driven map (random unknown passwords, since these users
  authenticate only via Vault-minted tokens).
- Drive it from config/netbox_user/<username>.yaml, scanned in config.hcl and
  wired through terragrunt inputs and the vault_cluster module, reusing the
  sanitized backend-alias pattern the Consul providers use.
- Define the terraform-infra user 1:1 with the engine role, granting write on
  the IPAM/DCIM objects terraform-infra manages (prefixes, ip-addresses,
  ip-ranges, devices, interfaces, mac addresses, and the supporting
  role/tag/type objects).
- Flip the terraform-infra role's netbox_username from svc-terraform-infra to
  terraform-infra so the engine role and NetBox username match exactly.

config/config.hcl

@@ -265,5 +265,10 @@ locals {
       })
       if startswith(file_path, "netbox_secret_backend_role/")
     }
+    netbox_user = {
+      for file_path, content in local.all_configs :
+      trimsuffix(basename(file_path), ".yaml") => content
+      if startswith(file_path, "netbox_user/")
+    }
   }
 }

config/netbox_secret_backend_role/netbox/terraform-infra.yaml

@@ -4,7 +4,7 @@
 # and revoked when the run's lease ends. Reading netbox/creds/terraform-infra
 # mints a lease-bound token deleted from NetBox on revoke/expiry.
 ---
-netbox_username: svc-terraform-infra
+netbox_username: terraform-infra
 write_enabled: true
 ttl: 120     # 2m
 max_ttl: 300 # 5m

config/netbox_user/terraform-infra.yaml

@@ -0,0 +1,31 @@
+# Declarative NetBox service identity for the terraform-infra CI runner. The
+# filename stem is the NetBox username and matches the netbox engine role name
+# 1:1 (netbox/roles/terraform-infra mints tokens for this user). Ben seeds only
+# the engine admin token; this user and its permissions are created from here,
+# never by hand. Write access covers the IPAM/DCIM objects terraform-infra
+# manages (prefixes, ip-addresses, ip-ranges, devices, interfaces, mac
+# addresses, plus the supporting role/tag/type objects it also touches).
+---
+backend: netbox
+active: true
+staff: false
+permissions:
+  - name: terraform-infra
+    description: terraform-infra IPAM/DCIM write access (tokens minted by Vault)
+    object_types:
+      - ipam.prefix
+      - ipam.ipaddress
+      - ipam.iprange
+      - ipam.role
+      - dcim.device
+      - dcim.interface
+      - dcim.macaddress
+      - dcim.manufacturer
+      - dcim.devicetype
+      - dcim.devicerole
+      - extras.tag
+    actions:
+      - view
+      - add
+      - change
+      - delete