Read mounted DB credentials from a Kubernetes snapshot

Secret volume rotation swaps ..data. Sequential reads of username then
password can tear across two leases. Resolve the snapshot once.

Also document why ESO AppRole login cannot parent database/creds leases:
the token discard DROP ROLEs the role ESO just stored.

deploy/clustersecretstore.yaml

@@ -1,9 +1,8 @@
 # Template of the railiance-platform add-on store. Prefer applying from:
 #   ~/railiance-platform/argocd/platform-addons/openbao-secretstore/openbao-audit-core.clustersecretstore.yaml
 #
-# AppRole auth (ops-mason plan audit-core-openbao-runtime-custody).
-# Prerequisite: Secret external-secrets/openbao-audit-core-approle
-# (role-id / secret-id), delivered by mason phase 4.
+# Token auth for database/creds (see comment on tokenSecretRef).
+# AppRole secret remains for a later lease-aware generator.
 ---
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
@@ -20,21 +19,19 @@ spec:
       path: platform
       version: v2
       auth:
-        appRole:
-          path: approle
-          roleRef:
-            name: openbao-audit-core-approle
-            namespace: external-secrets
-            key: role-id
-          secretRef:
-            name: openbao-audit-core-approle
-            namespace: external-secrets
-            key: secret-id
+        # Dynamic DB leases are revoked when the requesting token dies.
+        # ESO AppRole login+discard therefore DROP ROLEs the lease it just
+        # stored. A renewable orphan token is the working ESO client for
+        # database/creds; the AppRole remains for a later lease-aware generator.
+        tokenSecretRef:
+          name: openbao-audit-core-eso-token
+          namespace: external-secrets
+          key: token
   conditions:
     - namespaces:
         - audit-core
 ---
-# Database engine, not KV. Same AppRole, different mount.
+# Database engine, not KV. Same ESO token, different mount.
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
@@ -50,16 +47,10 @@ spec:
       path: database
       version: v1
       auth:
-        appRole:
-          path: approle
-          roleRef:
-            name: openbao-audit-core-approle
-            namespace: external-secrets
-            key: role-id
-          secretRef:
-            name: openbao-audit-core-approle
-            namespace: external-secrets
-            key: secret-id
+        tokenSecretRef:
+          name: openbao-audit-core-eso-token
+          namespace: external-secrets
+          key: token
   conditions:
     - namespaces:
         - audit-core