[Deploy] Vault initialization — policies, DEKs, JWT keys, service tokens

[maxzaikin]

Summary

Create Vault initialization scripts and policy files
for production deployment.

Context

See Operations-Vault-Init and
ADR-002

Acceptance Criteria

• deploy/vault/vault.hcl — Vault server configuration
• deploy/vault/policies/vfw-app.hcl — application policy
• deploy/vault/policies/vfw-auditor.hcl — auditor read-only policy
• deploy/vault/policies/vfw-plugin.hcl — plugin minimal scope policy
• deploy/scripts/vault-init.sh — initialization script:
  • Enable kv-v2 at vfw/
  • Enable transit engine
  • Enable approle auth
  • Enable audit log
  • Create policies
  • Generate DEKs for all three databases
  • Generate JWT RS256 key pair
  • Store RabbitMQ and MinIO credentials
  • Create service tokens
  • Output: remind operator to save Shamir shares offline
• Script is idempotent (safe to review what would be done)
• Script does NOT auto-unseal (Shamir ceremony is manual)
• Verified: script runs successfully against dev Vault