Register create-only Secrets Engine approval requester

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

config/service-clients.example.yaml

@@ -101,3 +101,19 @@ clients:
     # Approval is a human-in-the-loop control, so MFA is required rather than
     # left to the provider default.
     mfaRequired: true
+
+  # Separate create-only requester; actor matches the existing Flex Auth subject.
+  - clientId: secrets-engine-requester
+    displayName: Secrets Engine T03 approval requester
+    audience: approval-engine
+    allowedScopes:
+    - approval:create
+    grantTypes:
+    - client_credentials
+    clientType: confidential
+    secretRef: env:KEYCAPE_SECRETS_ENGINE_REQUESTER_CLIENT_SECRET
+    serviceSubject: secrets-engine
+    tenant: tenant:platform
+    roles:
+    - secrets-engine-requester
+    tokenLifetime: 15m