vault_kv_secret_v2 (terraform-infra providers.tf data source) reads the kv-v2
metadata path on every plan/apply once the secret is seeded; grant read on
kv/metadata/service/terraform/infra so the plan doesn't 403 (mirrors the
terraform-git gitea config policy pattern). Follow-up to the merged #111 which
shipped data-read only.
Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben