feat: add Azure Key Vault and HashiCorp Vault parameter providers

[fedemaleh]

Summary

Adds the two remaining parameter storage providers to complete the backend set (AWS Secrets Manager + Parameter Store landed in #1):

• Azure Key Vault — setup/store/retrieve/delete, native versioning (soft-delete + best-effort purge on delete), AKV-safe name transform (/,= → -).
• HashiCorp Vault — setup/store/retrieve/delete against KV v2, version encoded into external_id, 404 treated as idempotent on delete.

Each provider ships its install specs (specs/*.tf + .tfvars.example + lock) and an architecture doc.

Tests

• make test-unit → all unit tests pass, including the new provider suites:
  • azure-key-vault: setup/store/retrieve/delete
  • hashicorp-vault: setup/store/retrieve/delete

Notes

• CHANGELOG updated under ## [Unreleased].
• Tofu lock files tracked (matching the AWS providers' convention); no state/real tfvars/.env committed.

[fedemaleh]

Superseded by the split PRs: #7 (HashiCorp Vault — tested, ready to merge) and #8 (Azure Key Vault — draft, pending testing). Closing this combined PR.