feat(openbao): hardened same-LAN tape-encryption key store for Kanrisha

A dedicated OpenBao deployment, kept OFF the Kanrisha tape host so a compromise
of the tape node can't reach the vault.

- Native TLS on the listener (self-signed by default via gen-tls.sh, or a
  CA-signed cert from a Smallstep CA over ACME) — no Caddy/Let's Encrypt;
  reached over the LAN, not the public internet.
- Integrated raft storage (clean snapshot-based DR).
- mlock on (cap_add IPC_LOCK + memlock unlimited + host swapoff in deploy.sh).
- Manual unseal by default; optional PKCS#11 HSM auto-unseal.
- deploy.sh: Docker install (Alpine/Debian/Alma), self-signed cert, .env seed,
  swapoff, firewall 8200/tcp, compose up; then prints init/unseal + the KV-v2 +
  AppRole bootstrap for Kanrisha + the raft-snapshot DR flow. Self-contained
  (config payload embedded by build.sh).
- Registered in automations.sh + the README deployment table.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deployments/openbao/.env.example

@@ -0,0 +1,31 @@
+# Copy to .env and fill in. docker compose picks .env up automatically.
+# deploy.sh seeds .env from this on first run; an existing .env is never
+# overwritten. Never commit the populated .env.
+
+# ─── Reachability ───────────────────────────────────────────────────────────
+# Address (IP or DNS name) the KANRISHA tape host uses to reach this vault on
+# the LAN. Seeds the self-signed cert SAN below and is what you point
+# [encryption.openbao].address at (https://${OPENBAO_ADDR}:8200).
+OPENBAO_ADDR=10.0.0.10
+
+# Interface the published API port binds to on the host. Default is all
+# interfaces; set the LAN IP to avoid listening anywhere else.
+OPENBAO_BIND=0.0.0.0
+
+# ─── TLS ────────────────────────────────────────────────────────────────────
+# Comma-separated SANs for the self-signed cert deploy.sh generates. Include
+# EVERY name/IP the tape host might use (deploy.sh appends OPENBAO_ADDR + the
+# loopback for you). To use a CA-signed cert instead (e.g. Smallstep over ACME),
+# drop tls.crt + tls.key into ./tls and these are ignored — see the README.
+OPENBAO_TLS_SANS=DNS:localhost,IP:127.0.0.1
+OPENBAO_TLS_DAYS=825
+
+# ─── Image tag ──────────────────────────────────────────────────────────────
+# Pin for reproducible deploys.
+OPENBAO_TAG=2.5.5
+
+# ─── Auto-unseal (optional; default is MANUAL unseal) ───────────────────────
+# Only used when the seal "pkcs11" stanza is enabled in config.hcl (and the HSM
+# module/device is mounted into the container). Otherwise leave blank and unseal
+# manually after each restart.
+OPENBAO_HSM_PIN=