Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs against the live coulombcore path. Allow non-interactive bootstrap via OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
Document two OpenBao instances and add forgejo-openbao-eso-token-apply for ClusterSecretStore openbao-forgejo on bao.coulomb.social.