docs: re-verify secrets-and-pki.md, no content drift found

Live-checked every claim: Vault mount list, SSH CA role TTLs/algorithm,
the Caddyfile's asymmetric-trust config for Vault (exact match), all
per-host consumer stack counts (12 rocky-docker / 10 automation,
verified against the authoritative docker_secret_templates source, not
just Vault KV path listings which include unrelated Kestra-flow
secrets), the cert-rebuild script's 19-day-incident story, and the
lifecycle diagram - all still accurate. Bumping verified date/SHAs only.

docs/secrets-and-pki.md

@@ -1,6 +1,6 @@
-<!-- verified: 2026-09-06
-     iac@49ff427 : ansible/roles/secure_vault, ansible/group_vars/all/vault_provisioner.yml, ansible/roles/monitoring/mqtt_client
-     rocky-docker-lxc@4f43dcc : caddy/Caddyfile
+<!-- verified: 2026-09-19
+     iac@f770e1c : ansible/roles/secure_vault, ansible/group_vars/all/vault_provisioner.yml, ansible/roles/monitoring/mqtt_client
+     rocky-docker-lxc@7dd5025 : caddy/Caddyfile
      trilium : Eu0wns00QOBG, wovVrgvoDVy2, 1seDR2nBmxKO, GW8BMoTKtRBe, JbKe9CHzOP9D, Tu7FX48fxSQZ, DvKxK0gHXsng, otSPaU6IfjlP
 -->