✨ feat(deploy): iac/ Vault provisioning + workflow (uses app_roles module from tools)

iac/providers.tf

@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    vault = {
+      source  = "vault"
+      version = "4.4.0"
+    }
+  }
+}
+
+provider "vault" {
+  address = "https://vault.arcodange.lab"
+  auth_login_jwt {
+    # TERRAFORM_VAULT_AUTH_JWT environment variable, set by the gitea OIDC step
+    mount = "gitea_jwt"
+    role  = "gitea_cicd_dance-lessons-coach"
+  }
+}