Prepare tenant-zero OpenBao roles and review platform essentials

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e324-abce-7e51-bb2b-496f097afdb0

openbao/auth/secrets-engine-jwt-role.json

@@ -0,0 +1,25 @@
+{
+  "role_type": "jwt",
+  "user_claim": "sub",
+  "bound_audiences": [
+    "secrets-engine-openbao"
+  ],
+  "bound_subject": "service:secrets-engine",
+  "bound_claims_type": "string",
+  "bound_claims": {
+    "principal_type": "service",
+    "tenant": "tenant:platform",
+    "roles": "secrets-engine",
+    "scope": "openbao:login"
+  },
+  "token_policies": [
+    "secrets-engine-login-self"
+  ],
+  "token_no_default_policy": true,
+  "token_type": "service",
+  "token_ttl": "5m",
+  "token_max_ttl": "5m",
+  "token_explicit_max_ttl": "5m",
+  "token_num_uses": 8,
+  "verbose_oidc_logging": false
+}