HashiCorp Vault / OpenBao secrets engine for BIND TSIG keys (static rotation + dynamic creds via bind-operator)