Grant terraform-infra kv metadata read

vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
metadata path on every plan/apply once the secret is seeded; grant read on
kv/metadata/service/terraform/infra so the plan doesn't 403 (mirrors the
terraform-git gitea config policy pattern). Follow-up to the merged #111 which
shipped data-read only.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT

policies/kv/service/terraform/infra.yaml

@@ -5,6 +5,11 @@ rules:
   - path: "kv/data/service/terraform/infra"
     capabilities:
       - read
+  # vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
+  # metadata path on every plan/apply; a 403 here fails the plan.
+  - path: "kv/metadata/service/terraform/infra"
+    capabilities:
+      - read
 
 auth:
   approle: