HashiCorp Vault / OpenBao secrets engine for Rancher API tokens (seeded root rotation + dynamic scoped creds via tokens.ext.cattle.io)