feat(vault): erp prod runtime may read the shared GCS backup creds (kv_read_paths)

Adds an optional kv_read_paths list to the app_policy module (default []) so an
app's env=prod runtime policy can read extra kvv2 data paths — e.g. a shared
backup-creds path owned by another app. Plumbed through the root applications
schema + module call (dynamic rule, read+list).

Set for erp: kv_read_paths = ["kvv2/data/longhorn/gcs-backup"], so the dedicated
Dolibarr backup CronJob (erp chart, gated) can read the existing GCS HMAC creds
via its own VaultStaticSecret instead of borrowing the Longhorn secret
cross-namespace or duplicating credentials.

No-op for every other app (default []). Only the `erp` runtime policy gains one
read+list rule.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hashicorp-vault/iac/main.tf

@@ -80,6 +80,7 @@ module "app_policies" {
   name                       = each.value.name
   envs                       = each.value.envs
   ops_policies               = each.value.ops_policies
+  kv_read_paths              = each.value.kv_read_paths
   service_account_names      = each.value.service_account_names
   service_account_namespaces = each.value.service_account_namespaces
   gitea_app_id               = var.gitea_app_id