system: enable homelab-deploy listener for all vault hosts

Add system/homelab-deploy.nix module that automatically enables the
listener on all hosts with vault.enable=true. Uses homelab.host.tier
and homelab.host.role for NATS subject subscriptions.

- Add homelab-deploy access to all host AppRole policies
- Remove manual listener config from vaulttest01 (now handled by system module)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

terraform/vault/approle.tf

@@ -30,6 +30,7 @@ locals {
       paths = [
         "secret/data/hosts/ha1/*",
         "secret/data/shared/backup/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
@@ -38,6 +39,7 @@ locals {
         "secret/data/hosts/monitoring01/*",
         "secret/data/shared/backup/*",
         "secret/data/shared/nats/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
       extra_policies = ["prometheus-metrics"]
     }
@@ -46,18 +48,21 @@ locals {
     "nats1" = {
       paths = [
         "secret/data/hosts/nats1/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
     "jelly01" = {
       paths = [
         "secret/data/hosts/jelly01/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
     "pgdb1" = {
       paths = [
         "secret/data/hosts/pgdb1/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
@@ -66,6 +71,7 @@ locals {
       paths = [
         "secret/data/hosts/ns1/*",
         "secret/data/shared/dns/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
@@ -73,6 +79,7 @@ locals {
       paths = [
         "secret/data/hosts/ns2/*",
         "secret/data/shared/dns/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
@@ -80,6 +87,7 @@ locals {
     "http-proxy" = {
       paths = [
         "secret/data/hosts/http-proxy/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
@@ -87,10 +95,10 @@ locals {
     "nix-cache01" = {
       paths = [
         "secret/data/hosts/nix-cache01/*",
+        "secret/data/shared/homelab-deploy/*",
       ]
     }
 
-    # Vault test host with homelab-deploy access
     "vaulttest01" = {
       paths = [
         "secret/data/hosts/vaulttest01/*",