fix: authenticate HashiCorp Vault login against the configured Enterprise namespace

[fedemaleh]

Summary

On Vault Enterprise, credentials and roles are scoped to a namespace, so the setup login must target that namespace — otherwise Vault returns access denied. Until now setup always logged in against the root namespace ($VAULT_ADDR/v1/auth/userpass/login/...), so namespace-scoped credentials failed authentication. store/retrieve/delete already worked because they embed the full VAULT_PATH_PREFIX (which carries the namespace) into their request paths — only the login was namespace-unaware.

Change

setup now derives the Vault namespace from VAULT_PATH_PREFIX (env VAULT_PATH_PREFIX / config .setup.namespace) and prefixes both the userpass and kubernetes login URLs with it.

Derivation rule — trailing /data only: the namespace is derived only when the prefix ends in the KV v2 data segment.

.setup.namespace	Namespace for login	KV path (store/retrieve)
secret/data/nullplatform (default)	(root, none)	secret/data/nullplatform/…
secret/data/team-x	(root, none)	secret/data/team-x/…
admin/ns/data	admin/ns	admin/ns/data/…
admin/team/sub/data	admin/team/sub	admin/team/sub/data/…

A data segment in the middle (the default, or any custom root-namespace subpath such as secret/data/team-x / kv/data/foo) is treated as a plain KV mount + path in the root namespace and derives no namespace. Since <mount>/data/<subpath> and <namespace>/data/<subpath> are textually indistinguishable, matching only a trailing /data is what keeps existing non-Enterprise deployments working unchanged.

Matching is segment-safe (.../database does not end in /data). The namespace path is not URL-encoded on purpose: its / are real path separators for nested namespaces.

Trade-off (documented)

An Enterprise namespace combined with a KV subpath after data (admin/ns/data/foo) is not auto-derived — configure the prefix ending at <namespace>/data.

Test plan

• bats parameters/tests/providers/hashicorp-vault/*.bats → 51/51 pass
• shellcheck clean on setup
• New tests cover: trailing-/data derivation (userpass + kubernetes), default → root login, non-default root prefix (secret/data/team-x) → root login (regression guard), subpath-after-data → root login, database segment-safety, and that the exported VAULT_PATH_PREFIX keeps its full value (store/retrieve compose paths from it verbatim).

Docs

Updated the provider README.md, docs/architecture.md, the config schema field description, and CHANGELOG.md.