feat(rotators): Vault dynamic-secrets rotator + thin Vault client
Vault::Client wraps token-auth REST: read_dynamic, revoke_lease,
renew_lease, health. Errors surface as VaultError carrying status.
VaultDynamicRotator's rotation contract leans on Vault as the secret
factory:
- generate: read_dynamic (Vault issues new creds + lease)
- apply: no-op (Vault already provisioned)
- verify: lease renewal acts as liveness check
- commit: revoke OLD lease (tracked in current_lease_id tag)
- rollback_apply: revoke NEW lease
8 unit specs cover client method round-trips, rotator full path with
old-lease revocation, verify-on-Vault-error handling, rollback, and
the no-old-lease pass-through case.
d431e9014e