refactor: use the OpenBao API client

[bajtos]

Replace github.com/hashicorp/vault-client-go with github.com/openbao/openbao/api/v2, the client OpenBao ships and keeps in step with the server we run.

The KV v2 calls move to client.KVv2(mount) (Get/Put/DeleteMetadata) and not-found now comes from api.ErrSecretNotFound, since the new client turns a 404 into that sentinel instead of surfacing the status. The 403 that drives the AppRole re-login is matched on api.ResponseError.

Secret paths and the base64 "value" field are unchanged, so stored key material stays readable and no migration is needed.

Close FIL-1107

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T07:30:36.781803Z	4382c60	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[bajtos]

I asked Claude about the itest failures:

ingot crash-loops on startup and compose gives up on it.

ingot: invalid config: 
  regionkey.provider is required (openbao or inprocess);
  tenantkey.plc_directory_url is required
stack_test.go:178: failed to create stack: compose up: 
  container smeltery-testforge-ingot-1 is unhealthy

The ghcr.io/fil-forge/ingot:main image now demands two config keys that smelt doesn't supply. Nothing in the pinned smelt (v0.0.0-20260825195303-2d623ae3f04e) sets them — systems/ingot/config/config.yaml and compose.yml have no regionkey or tenantkey section, and INGOT_* env vars only override keys the file already defines (its README says so). The fix belongs in smelt: add the two keys, then bump the github.com/fil-forge/smelt pin here. To unblock locally in the meantime, point HILT_ITEST_INGOT_IMAGE at an ingot build from before the config change.

@ash can you PTAL?