feat: vend platform-pg-backup-s3 via AppRole ESO

Policy and AppRole applied. Store Valid, ExternalSecret SecretSynced.
Prefix empty. WAL not enabled.

argocd/platform-addons/openbao-secretstore/openbao-backup-object-storage.clustersecretstore.yaml

@@ -1,11 +1,9 @@
-# DRAFT — CCR-2026-0012. Do not apply until the CCR is approved and the
-# KV values are real. Deploy on railiance01 (first consumer lives in
+# CCR-2026-0012. Deploy on railiance01 (first consumer lives in
 # databases), not the CoulombCore ArgoCD kustomization.
 #
-# Prereq: ESO can authenticate to OpenBao with policy
-# workload-kv-read-backup-object-storage. Interim railiance01 identity
-# may be AppRole or a child token; Kubernetes auth role
-# external-secrets-backup-object-storage is the CCR-declared steady state.
+# Prereq: Secret external-secrets/openbao-backup-object-storage-approle
+# (role-id, secret-id) for AppRole external-secrets-backup-object-storage.
+# Same-cluster Kubernetes auth remains the follow-up.
 # Add further namespace conditions when another backup consumer is bound.
 apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
@@ -22,12 +20,16 @@ spec:
       path: platform
       version: v2
       auth:
-        kubernetes:
-          mountPath: kubernetes
-          role: external-secrets-backup-object-storage
-          serviceAccountRef:
-            name: external-secrets
+        appRole:
+          path: approle
+          roleRef:
+            name: openbao-backup-object-storage-approle
             namespace: external-secrets
+            key: role-id
+          secretRef:
+            name: openbao-backup-object-storage-approle
+            namespace: external-secrets
+            key: secret-id
   conditions:
     - namespaces:
         - databases