migrate all secrets from SOPS to Vault KV

- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.

stacks/tuya-bridge/main.tf

@@ -2,20 +2,11 @@ variable "tls_secret_name" {
   type      = string
   sensitive = true
 }
-variable "tiny_tuya_api_key" {
-  type      = string
-  sensitive = true
-}
-variable "tiny_tuya_api_secret" {
-  type      = string
-  sensitive = true
-}
-variable "tiny_tuya_service_secret" {
-  type      = string
-  sensitive = true
-}
-variable "tiny_tuya_slack_url" { type = string }
 
+data "vault_kv_secret_v2" "secrets" {
+  mount = "secret"
+  name  = "tuya-bridge"
+}
 
 resource "kubernetes_namespace" "tuya-bridge" {
   metadata {
@@ -64,19 +55,19 @@ resource "kubernetes_deployment" "tuya-bridge" {
           }
           env {
             name  = "TINYTUYA_API_KEY"
-            value = var.tiny_tuya_api_key
+            value = data.vault_kv_secret_v2.secrets.data["api_key"]
           }
           env {
             name  = "TINYTUYA_API_SECRET"
-            value = var.tiny_tuya_api_secret
+            value = data.vault_kv_secret_v2.secrets.data["api_secret"]
           }
           env {
             name  = "SERVICE_API_KEY" # used for auth the API endpoint
-            value = var.tiny_tuya_service_secret
+            value = data.vault_kv_secret_v2.secrets.data["service_secret"]
           }
           env {
             name  = "SLACK_URL"
-            value = var.tiny_tuya_slack_url
+            value = data.vault_kv_secret_v2.secrets.data["slack_url"]
           }
           resources {
             requests = {