Move secret management toward Vaultwarden and OpenBao

[Twix166]

Summary

• remove tracked SOPS config and encrypted secret payloads from the repo
• add zero-secret Git guardrails for Vaultwarden/OpenBao data, tokens, exports, snapshots, and runtime files
• add Vaultwarden + OpenBao migration plan, bootstrap runbook, example compose scaffold, OpenBao config scaffold, and metadata-only inventory examples

Validation

• python3 scripts/secrets/validate_no_git_secrets.py
• git diff --cached --check
• YAML parse for compose/compose.secrets.example.yaml
• JSON parse for secrets/inventory.example.json

Notes

• This does not deploy Vaultwarden/OpenBao yet.
• Bootstrap secrets, unseal/recovery material, and real migrations need Robert present and must stay out of GitHub.