Render stack secrets from OpenBao in compose_stack

stack_secrets reads KV v2 on the target host and writes the stack's .env at
0600, failing loudly on a sealed vault, a bad token, a missing field or an
unsafe value. Adds an example OpenBao stack on app and moves webapp onto it;
metrics keeps a hand-placed .env.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/app/webapp/docker-compose.yml

@@ -2,9 +2,9 @@
 #
 # Every credential comes from .env, with no defaults. `${VAR:?message}` makes
 # Compose refuse to start and say which variable is missing, which is strictly
-# better than booting with an empty password. .env lives on the host and is never
-# synced from this repository, so ansible/playbooks/webapp.yml asserts it is
-# there before doing anything.
+# better than booting with an empty password. .env is never synced from this
+# repository: the compose_stack role renders it on the host from OpenBao, from
+# the stack_secrets in ansible/playbooks/webapp.yml.
 services:
   db:
     container_name: webapp-db
@@ -18,7 +18,7 @@ services:
     environment:
       POSTGRES_DB: webapp
       POSTGRES_USER: webapp
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set it in .env on the host}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?missing from .env; see stack_secrets in webapp.yml}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U webapp"]
       interval: 10s
@@ -39,8 +39,8 @@ services:
       db:
         condition: service_healthy
     environment:
-      DATABASE_URL: postgres://webapp:${POSTGRES_PASSWORD:?set it in .env on the host}@db:5432/webapp
-      SECRET_KEY: ${SECRET_KEY:?set it in .env on the host}
+      DATABASE_URL: postgres://webapp:${POSTGRES_PASSWORD:?missing from .env; see stack_secrets in webapp.yml}@db:5432/webapp
+      SECRET_KEY: ${SECRET_KEY:?missing from .env; see stack_secrets in webapp.yml}
       # Set by the role to stack_dest, so a path handed to a sibling container is
       # the path on the host and not wherever the SSH session happened to land.
       UPLOAD_HOST_DIR: ${PWD}/uploads