migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/immich/frame.tf

@@ -23,7 +23,7 @@ resource "kubernetes_config_map" "mailserver_config" {
         ShowProgressBar: false
     Accounts:
         - ImmichServerUrl: http://immich.viktorbarzin.me
-          ApiKey: ${var.immich_frame_api_key}
+          ApiKey: ${data.vault_kv_secret_v2.secrets.data["frame_api_key"]}
           Albums: 
             - 1aa98849-bbd5-452b-aac0-310b210a8597 # china
     EOF