terraform: add ns1 and ns2 to AppRole policies

They were missing from the host_policies map, so they didn't get
shared policies like loki-push.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

terraform/vault/approle.tf

@@ -90,6 +90,19 @@ locals {
     }
 
     # Wave 3: DNS servers
+    "ns1" = {
+      paths = [
+        "secret/data/hosts/ns1/*",
+        "secret/data/shared/dns/*",
+      ]
+    }
+
+    "ns2" = {
+      paths = [
+        "secret/data/hosts/ns2/*",
+        "secret/data/shared/dns/*",
+      ]
+    }
 
     # Wave 4: http-proxy
     "http-proxy" = {