migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/calibre/main.tf

@@ -2,12 +2,17 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "homepage_credentials" {
-  type      = map(any)
-  sensitive = true
-}
 variable "nfs_server" { type = string }
 
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "calibre"
+}
+
+locals {
+  homepage_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["homepage_credentials"])
+}
+
 
 resource "kubernetes_namespace" "calibre" {
   metadata {
@@ -194,6 +199,24 @@ resource "kubernetes_deployment" "calibre-web-automated" {
           port {
             container_port = 8083
           }
+          # Startup probe: allow up to 10 min for calibre binary install on first boot
+          startup_probe {
+            http_get {
+              path = "/"
+              port = 8083
+            }
+            initial_delay_seconds = 30
+            period_seconds        = 10
+            failure_threshold     = 54
+          }
+          liveness_probe {
+            http_get {
+              path = "/"
+              port = 8083
+            }
+            period_seconds    = 30
+            failure_threshold = 3
+          }
           resources {
             requests = {
               cpu    = "50m"
@@ -274,8 +297,8 @@ module "ingress" {
     "gethomepage.dev/name"            = "Calibre"
     "gethomepage.dev/widget.type"     = "calibreweb"
     "gethomepage.dev/widget.url"      = "http://calibre.calibre.svc.cluster.local"
-    "gethomepage.dev/widget.username" = var.homepage_credentials["calibre-web"]["username"]
-    "gethomepage.dev/widget.password" = var.homepage_credentials["calibre-web"]["password"]
+    "gethomepage.dev/widget.username" = local.homepage_credentials["calibre-web"]["username"]
+    "gethomepage.dev/widget.password" = local.homepage_credentials["calibre-web"]["password"]
     "gethomepage.dev/pod-selector"    = ""
     # gethomepage.dev/weight: 10 # optional
     # gethomepage.dev/instance: "public" # optional