modules: add env/envs parameter to app_roles + app_policy (multi-env)

Phase A of the multi-environment evolution agreed in the erp repo design
thread. Both modules gain an optional env coordinate that defaults to
"prod"; by the elision rule, env=prod produces the existing single-env
derived names character-for-character, so every existing app's tofu plan
is a no-op.

app_roles (per-instance module — caller iterates over envs):
- variables.tf: add optional env = "prod"
- main.tf: compute local.instance via elision rule + local.owner_role
  (snake-case <name>_<env>_role for the Postgres owner). The name/env/
  database locals are grouped so fmt keeps the existing `name` alignment
  (no whitespace churn on unchanged keys).
- main.tf: substitute local.name -> local.instance / local.owner_role in
  the dynamic role name, k8s role name, SA bindings, token_policies
- outputs.tf: add env + instance outputs; kvv2_path_prefix derives from
  local.instance (== local.name when env=prod → backwards-compat)

app_policy (per-repo module — accepts list of envs):
- variables.tf: add optional envs = ["prod"]
- main.tf: compute local.instances + local.non_prod_instances; remove the
  now-dead bound_service_account_* alias locals (the allowed_parameter
  blocks build their values from per_instance_sa_* maps instead)
- main.tf: kvv2 ops rules become dynamic blocks iterating local.instances
  in the original order (data, delete, undelete, destroy, metadata), so a
  prod-only app renders a byte-identical policy document
- main.tf: allowed_parameter for bound_service_account_* + token_policies
  use comprehensions over local.instances (1-element → identical to old
  static values for prod-only apps)
- main.tf: keep vault_policy.app (env=prod runtime policy) at its original
  address; add vault_policy.app_non_prod via for_each over non_prod_instances
  (empty set for prod-only apps → no new resources)

Top-level wiring:
- iac/variables.tf: add envs = optional(list(string), ["prod"]) to the
  applications set(object) type
- iac/main.tf: pass envs = each.value.envs to app_policies

Verified: `tofu fmt -check` clean on all touched files, `tofu validate`
passes. Backwards-compat reasoning for the no-op plan is in the PR body.

Phase B (factory postgres iac + argocd + runbook docs) and Phase D
(erp iac/main.tf for_each + activate sandbox) follow in their own PRs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hashicorp-vault/iac/modules/app_policy/main.tf

@@ -8,18 +8,14 @@
 locals {
   name = lower(var.name)
   envs = [for e in var.envs : lower(e)]
+
   # Elision rule: env=prod → bare name; else <name>-<env>
-  instances = [for e in local.envs : e == "prod" ? local.name : "${local.name}-${e}"]
-  # Non-prod instances only (for the per-env runtime policy iteration that doesn't touch the prod state address)
+  instances          = [for e in local.envs : e == "prod" ? local.name : "${local.name}-${e}"]
   non_prod_instances = [for e in local.envs : "${local.name}-${e}" if e != "prod"]
 
   # Per-instance SA name/namespace sets used by the CI policy's allowed_parameter blocks.
   per_instance_sa_names      = { for inst in local.instances : inst => concat([inst], var.service_account_names) }
   per_instance_sa_namespaces = { for inst in local.instances : inst => concat([inst], var.service_account_namespaces) }
-
-  # Backwards-compat aliases kept for any caller that referenced these (unused outside the module).
-  bound_service_account_names      = concat([var.name], var.service_account_names)
-  bound_service_account_namespaces = concat([var.name], var.service_account_namespaces)
 }
 
 data "vault_policy_document" "ops" {

hashicorp-vault/iac/modules/app_roles/main.tf

@@ -3,17 +3,17 @@ data "vault_auth_backend" "kubernetes" {
 }
 
 locals {
-  name = lower(var.name)
-  env  = lower(var.env)
+  name     = lower(var.name)
+  env      = lower(var.env)
+  database = var.database == null ? local.instance : var.database
+
   # Elision rule (factory runbook conventions.md):
   #   env == prod → identical to the single-env baseline (no suffix)
-  #   else        → kebab-case "<name>-<env>" for K8s/Vault paths
-  instance = local.env == "prod" ? local.name : "${local.name}-${local.env}"
+  #   else        → kebab-case "<name>-<env>" for K8s/Vault paths.
   # Postgres owner role stays snake-case for consistency with the existing "_role" suffix.
+  instance   = local.env == "prod" ? local.name : "${local.name}-${local.env}"
   owner_role = local.env == "prod" ? "${local.name}_role" : "${local.name}_${local.env}_role"
 
-  database = var.database == null ? local.instance : var.database
-
   bound_service_account_names      = concat([local.instance], var.service_account_names)
   bound_service_account_namespaces = concat([local.instance], var.service_account_namespaces)