Add AppRole-backed Qonto secret store

argocd/platform-addons/openbao-secretstore/openbao-rapp-qonto.clustersecretstore.yaml

@@ -0,0 +1,34 @@
+# Transitional cross-cluster bridge: the credential remains in Coulombcore
+# OpenBao while rapp-qonto runs on railiance01. ESO uses a dedicated AppRole
+# to mint short-lived tokens; replace this with same-cluster Kubernetes auth
+# when secret custody and workload placement are unified.
+#
+# Prerequisite: Secret external-secrets/openbao-rapp-qonto-approle with keys
+# role-id and secret-id, delivered by the approved ops-mason construction plan.
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: openbao-rapp-qonto
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+spec:
+  provider:
+    vault:
+      server: https://bao.coulomb.social
+      path: tenants
+      version: v2
+      auth:
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-rapp-qonto-approle
+            namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-rapp-qonto-approle
+            namespace: external-secrets
+            key: secret-id
+  conditions:
+    - namespaces:
+        - rapp-qonto