Grant agents approle write on ghp config KV path (to seed) (#128)

## Why

The `terraform-vault` master apply aborts because the KV path `kv/data/service/vault/au/syd1/secret_backend/ghp/config` (key `admin_token`, a `ghpsvc_` service token) is unseeded. The ghp secrets engine reads that value at `ghp/config` creation time, so the ghp data-source read fails and the apply stops. Granting the `agents` AppRole scoped write to just this one KV path lets an agent seed the value so the apply can proceed.

## Changes

- Add `policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml`, a `vault_policy` bound to the `agents` AppRole role only.
- Grant `create`, `update`, `read` on the kv-v2 data path `kv/data/service/vault/au/syd1/secret_backend/ghp/config`.
- Grant `read` on the kv-v2 metadata path `kv/metadata/service/vault/au/syd1/secret_backend/ghp/config` (read on plan/apply).
- Scope to this single ghp config path only; no wildcards, no delete, no list, no other `secret_backend` configs (least privilege).

## Caveat

This grant is itself a `vault_policy` applied by the master apply, which currently aborts on the ghp data-source read. So the policy likely needs to be applied first (a targeted apply of just this `vault_policy`) before the agent can seed the KV path. The agent also still needs the actual `ghpsvc_` service token value provided out-of-band to write into `admin_token`.

---------

Co-authored-by: BenVincent <benvin@main.unkin.net>
Co-authored-by: unkin-agent <agent@unkin.net>
Reviewed-on: #128
Co-authored-by: Unkin Agent <unkin-agent@unkin.net>
Co-committed-by: Unkin Agent <unkin-agent@unkin.net>

policies/kv/service/vault/au/syd1/secret_backend/ghp/config_write.yaml

@@ -0,0 +1,24 @@
+# Allow the agents AppRole to seed the ghp secrets engine's admin credentials.
+# The ghp engine (managed by the tf_vault deployer) reads its ghpsvc_ service
+# token from admin_token at ghp/config creation time; that key is currently
+# unseeded, so the master apply aborts on the ghp data-source read. This grants
+# the agents AppRole scoped write here so an agent can seed the value. Deployer
+# read is already granted via policies/kv/service/vault/secret_backends_read.yaml,
+# so this only adds the write side for the agents identity.
+---
+rules:
+  # Seed value: admin_token (a ghpsvc_ service token). create/update to seed,
+  # read so the agent can verify what it wrote. No delete (least privilege).
+  - path: "kv/data/service/vault/au/syd1/secret_backend/ghp/config"
+    capabilities:
+      - create
+      - update
+      - read
+  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply.
+  - path: "kv/metadata/service/vault/au/syd1/secret_backend/ghp/config"
+    capabilities:
+      - read
+
+auth:
+  approle:
+    - agents