Render stack secrets from OpenBao in compose_stack

stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/deploy.yml

@@ -26,6 +26,7 @@ on:
           - reverse-proxy
           - banner
           - metrics
+          - openbao
           - static-site
           - webapp
           - webapp-staging
@@ -145,6 +146,11 @@ jobs:
         working-directory: ansible
         env:
           ANSIBLE_FORCE_COLOR: "1"
+          # Read by the compose_stack role through lookup('env', ...) for stacks
+          # that set stack_secrets. It goes through the environment and never
+          # through ${{ }} into the run: body, for the reason the Validate step
+          # above spells out. See docs/secrets.md.
+          VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
         run: |
           set -eu
           # An `if`, not `[ ... ] && extra=...`: when the test fails the AND-list