feat: manage litellm secrets engine via terraform-provider-litellmvaultsecret

The vault-plugin-secrets-litellm engine mints LiteLLM virtual keys and is
now registered in Vault, but nothing declared its mount/config or roles in
this repo. Wire in the companion litellm provider so the mount is managed
as code alongside the other secret backends.

- Add litellm_secret_backend module: mounts the engine and writes its
  config (base_url, request_timeout_seconds); reads master_key from KV
- Add litellm_secret_backend_role module: manages roles (models,
  max_budget, key_alias_prefix, ttl/max_ttl seconds, metadata)
- Register both modules in vault_cluster main.tf and variables.tf
- Discover litellm_secret_backend[_role] YAML in config.hcl and pass them
  through terragrunt inputs
- Declare the litellm provider (git.unkin.net/unkin/litellmvaultsecret) and
  a provider block in the generated root backend.tf
- Add example config for the litellm mount and a sample role

config/litellm_secret_backend_role/litellm/rspamd.yaml

@@ -1,10 +0,0 @@
----
-models:
-  - claude-haiku-4-5
-  - claude-sonnet-4-6
-max_budget: 50
-ttl: 3600      # seconds (1h)
-max_ttl: 86400 # seconds (24h)
-metadata:
-  team: mailfiltering
-  env: prod

config/litellm_secret_backend_role/litellm/team-a.yaml

@@ -0,0 +1,11 @@
+# Role on the "litellm" mount (directory name = backend mount path).
+# Constrains the virtual keys generated from creds/team-a.
+models:
+  - gpt-4
+  - gpt-3.5-turbo
+max_budget: 50
+ttl: 3600      # seconds (1h)
+max_ttl: 86400 # seconds (24h)
+metadata:
+  team: a
+  env: prod

environments/root.hcl

@@ -36,7 +36,7 @@ terraform {
       version = "2.23.0"
     }
     litellm = {
-      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
+      source  = "git.unkin.net/unkin/litellmvaultsecret"
       version = "0.1.0"
     }
   }

policies/litellm/admin.yaml

@@ -1,26 +0,0 @@
-# Allow management of the LiteLLM secrets engine (config and roles)
----
-rules:
-  - path: "litellm/config"
-    capabilities:
-      - create
-      - update
-      - read
-      - delete
-  - path: "litellm/roles/*"
-    capabilities:
-      - create
-      - update
-      - delete
-      - read
-      - list
-  - path: "litellm/roles"
-    capabilities:
-      - read
-      - list
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault