Vault auto-unseal (future improvement)

Deferred by the owner on 2026-10-10. Context in https://github.com/helmcode/nan-devops/blob/main/AGENT-AUTOMATIONS.md §9.1: Vault uses manual Shamir unseal; options are (A) Transit auto-unseal from a dedicated unseal Vault on a small Hetzner Cloud VM outside k3s, or (B) a cloud KMS just for unsealing. Rejected: unseal keys in a k8s Secret.