feat(openbao): serve the web UI, so init/unseal can happen in a browser

config.hcl shipped `ui = false`, so there was no UI to reach even with working
connectivity. That forces init and unseal through `docker compose exec`, which
puts the unseal keys and root token into a server shell's history and
scrollback -- the one place they should never be.

Make it a substitution point driven by OPENBAO_UI, default on. This adds no
exposure: the UI is served on the same listener, and anything that can reach
:8200 can already do everything through the API. What it changes is where the
unseal material is displayed -- the operator's browser instead of the host.

Rendering config.hcl rather than copying it needed three things to be right:

- Precedence. OPENBAO_UI passed to a run wins; otherwise the value .env already
  deploys applies; otherwise the default. Without that, `OPENBAO_UI=0 bash
  deploy.sh` against an existing node would report success and change nothing.
  Env-presence is captured before the ":=" default, so an explicit 0 is
  distinguishable from "not mentioned" and a re-run cannot silently re-enable
  the UI. A value passed this run is written back to .env.
- Reload. A bind-mounted file's CONTENTS are not part of the compose config
  hash, so `up -d` leaves a changed config.hcl unloaded -- the same trap fixed
  in copyparty (76d2a09) and simplex (0f22735). Restart only on an actual
  change, and say loudly that a restart RE-SEALS the vault, because that is not
  a free action on a running one.
- `cmp -s` stays inside an `if` condition; as `cmp -s A B && CONFIG_CHANGED=1`
  it would trip set -e whenever the files matched.

Verified: default renders `ui = true` and seeds .env; an identical re-run
reports no change; .env's 0 is honoured when nothing is passed; a passed 1 beats
.env's 0 and is written through; a non-boolean value dies.

Note for LAN-isolated hosts: the listener publishes on OPENBAO_BIND only, so a
browser on another subnet still cannot reach it. The generated cert already
carries DNS:localhost + IP:127.0.0.1 in its SANs, so
`ssh -L 8200:<bind-addr>:8200` and https://localhost:8200 works against the
existing cert without widening the publish.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deployments/openbao/.env.example

@@ -25,6 +25,13 @@ OPENBAO_BIND=0.0.0.0
 OPENBAO_TLS_SANS=
 OPENBAO_TLS_DAYS=825
 
+# ─── Web UI ─────────────────────────────────────────────────────────────────
+# 1 = serve the built-in web UI on the same listener (default), 0 = API only.
+# Not a new exposure: anything that can reach :8200 can already do everything
+# via the API. With the UI on you can initialise and unseal from a browser,
+# which keeps the unseal keys out of a server shell's history.
+OPENBAO_UI=1
+
 # ─── Image tag ──────────────────────────────────────────────────────────────
 # Pin for reproducible deploys.
 OPENBAO_TAG=2.5.5