Use https://bao.coulomb.social with token auth until railiance01 OpenBao is bootstrapped; the in-cluster railiance01 instance is not initialized.
Introduce external-secrets-forgejo policy/role, ClusterSecretStore openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.