Render stack secrets from OpenBao in compose_stack

stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ci-gitlab.md

@@ -19,7 +19,8 @@ Settings → CI/CD → Variables. Mark every one **Protected**.
 | `SSH_KEY_BACKEND` | `ci` | Already set as a job default; override only to use `vault` |
 | `SSH_PRIVATE_KEY_B64` | the deploy key, base64, one line | **Masked** |
 | `SSH_PRIVATE_KEY` | the raw key | Alternative: type **File**, cannot be masked |
-| `VAULT_ADDR` / `VAULT_TOKEN` | a vault address and token | Only for the `vault` backend |
+| `VAULT_TOKEN` | the `stacks-read` token | **Masked**. For stacks that set `stack_secrets` — see [secrets.md](secrets.md) §2 |
+| `VAULT_ADDR` | a vault address | Only for the `vault` key backend, which reads `VAULT_TOKEN` too — a token used for both needs read on the key's path as well |
 
 **Protected matters more than it looks.** A protected variable exists only on
 protected branches and tags. A pipeline on an ordinary feature branch gets an