migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/ollama/main.tf

@@ -2,13 +2,18 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "ollama_api_credentials" {
-  type      = map(string)
-  sensitive = true
-}
 variable "nfs_server" { type = string }
 variable "ollama_host" { type = string }
 
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "ollama"
+}
+
+locals {
+  api_credentials = jsondecode(data.vault_kv_secret_v2.secrets.data["api_credentials"])
+}
+
 
 resource "kubernetes_namespace" "ollama" {
   metadata {
@@ -167,11 +172,11 @@ module "ollama-ingress" {
 
 # Ollama API ingress for external access (basicAuth protected)
 locals {
-  ollama_api_htpasswd = join("\n", [for name, pass in var.ollama_api_credentials : "${name}:${bcrypt(pass, 10)}"])
+  ollama_api_htpasswd = join("\n", [for name, pass in local.api_credentials : "${name}:${bcrypt(pass, 10)}"])
 }
 
 resource "kubernetes_secret" "ollama_api_basic_auth" {
-  count = length(var.ollama_api_credentials) > 0 ? 1 : 0
+  count = length(local.api_credentials) > 0 ? 1 : 0
   metadata {
     name      = "ollama-api-basic-auth-secret"
     namespace = kubernetes_namespace.ollama.metadata[0].name
@@ -188,7 +193,7 @@ resource "kubernetes_secret" "ollama_api_basic_auth" {
 }
 
 resource "kubernetes_manifest" "ollama_api_basic_auth_middleware" {
-  count = length(var.ollama_api_credentials) > 0 ? 1 : 0
+  count = length(local.api_credentials) > 0 ? 1 : 0
   manifest = {
     apiVersion = "traefik.io/v1alpha1"
     kind       = "Middleware"