Adds the real Vault Agent secret-rendering templates and non-secret
env vars for authentik, vaultwarden, and wazuh - sanitized (real
domain/email/SMTP provider genericized, kv/<host>/... paths use a
generic 'host' placeholder instead of the real hostname). This is
the standing pattern for the rest of stacks/ going forward.
