Render stack secrets from OpenBao in compose_stack

stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/app/webapp/.env.example

@@ -1,11 +1,11 @@
-# Copy to .env ON THE HOST, not here. The compose_stack role excludes .env from
-# every sync (stack_exclude), so a .env committed to this repository would be
-# ignored, and a host's .env is never overwritten by a deploy.
+# Documentation, not a template. The compose_stack role renders .env on the host
+# from OpenBao during every sync, from the stack_secrets in
+# ansible/playbooks/webapp.yml (and webapp-staging.yml, from its own path). Edits
+# to a .env on the host are overwritten by the next deploy.
 #
-#   ssh deploy@app.example.com
-#   cd /srv/stacks/webapp && cp .env.example .env && $EDITOR .env
+#   POSTGRES_PASSWORD   kv/stacks/webapp  field postgres_password
+#   SECRET_KEY          kv/stacks/webapp  field secret_key
 #
-# webapp.yml refuses to deploy if .env is absent on the host, because every
-# variable below is required with no default.
+# See "Adding a secret" in docs/secrets.md.
 POSTGRES_PASSWORD=
 SECRET_KEY=