docs: secrets-and-pki.md - add missing NetBird row to consumer table

Found while auditing secret-distribution.md: NetBird is one of the 6
real docker_secret_templates-consuming hosts (confirmed via Agent
Configurations KB note and the live template list - config.yaml,
Hawser's secret, shared registry-token), but was missing from this
doc's consumer table entirely.

docs/secrets-and-pki.md

@@ -68,6 +68,7 @@ Every Vault Agent reaches Vault through the internal app-to-app proxy zone descr
 | User-Facing Proxy | Server + client certs for the mTLS-enforced browser zone, plus a shared registry-token render and Hawser's application secret |
 | Internal DNS | Server cert for its own admin UI/API only |
 | Security Monitoring | Its manager and dashboard services' shared secrets (indexer, API, dashboard passwords), plus Hawser's application secret, plus a shared registry-token render |
+| NetBird | Its entire server config rendered as one file, embedded secrets included — the same file-templating pattern used for Kestra's `application.yml` — plus Hawser's application secret, plus a shared registry-token render |
 
 None of these ever call the Vault API themselves — every one of them goes through the same local-render sequence: