migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/freedify/main.tf

@@ -2,9 +2,13 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "freedify_credentials" {
-  type      = map(any)
-  sensitive = true
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "freedify"
+}
+
+locals {
+  credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["credentials"])
 }
 
 
@@ -40,11 +44,11 @@ module "viktor" {
   depends_on         = [kubernetes_namespace.freedify]
   tier               = local.tiers.aux
   protected          = true
-  listenbrainz_token = lookup(var.freedify_credentials["viktor"], "listenbrainz_token", null)
-  genius_token       = lookup(var.freedify_credentials["viktor"], "genius_token", null)
-  dab_session        = lookup(var.freedify_credentials["viktor"], "dab_session", null)
-  dab_visitor_id     = lookup(var.freedify_credentials["viktor"], "dab_visitor_id", null)
-  gemini_api_key     = lookup(var.freedify_credentials["viktor"], "gemini_api_key", null)
+  listenbrainz_token = lookup(local.credentials["viktor"], "listenbrainz_token", null)
+  genius_token       = lookup(local.credentials["viktor"], "genius_token", null)
+  dab_session        = lookup(local.credentials["viktor"], "dab_session", null)
+  dab_visitor_id     = lookup(local.credentials["viktor"], "dab_visitor_id", null)
+  gemini_api_key     = lookup(local.credentials["viktor"], "gemini_api_key", null)
   extra_annotations = {
     "gethomepage.dev/enabled"      = "true"
     "gethomepage.dev/name"         = "Freedify (Viktor)"
@@ -64,8 +68,8 @@ module "emo" {
   depends_on      = [kubernetes_namespace.freedify]
   tier            = local.tiers.aux
   protected       = true
-  genius_token    = lookup(var.freedify_credentials["emo"], "genius_token", null)
-  gemini_api_key  = lookup(var.freedify_credentials["emo"], "gemini_api_key", null)
+  genius_token    = lookup(local.credentials["emo"], "genius_token", null)
+  gemini_api_key  = lookup(local.credentials["emo"], "gemini_api_key", null)
   extra_annotations = {
     "gethomepage.dev/enabled"      = "true"
     "gethomepage.dev/name"         = "Freedify (Emo)"

stacks/freedify/providers.tf

@@ -1,7 +1,7 @@
 # Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
 variable "kube_config_path" {
-  type    = string
-  default = "~/.kube/config"
+  type      = string
+  default   = "~/.kube/config"
   sensitive = true
 }
 

stacks/freedify/terragrunt.hcl

@@ -6,3 +6,8 @@ dependency "platform" {
   config_path  = "../platform"
   skip_outputs = true
 }
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}