Add AWS vault-utils: Secrets Manager, KMS bootstrap, and Raft health

[amitslog]

This slice adds the AWS path in vault-utils so an EC2 node can init once with KMS auto-unseal, write init and platform tokens to Secrets Manager, and fail closed if SM or unseal does not work. Health serve listens on 8210 and returns 200 only when this node is a Raft voter and caught up. Snapshots go to the connected S3 prefix when SNAPSHOT_BUCKET is set. backup_schedule is a cron expression. Empty means off.

ASG, NLB, AMI, and user-data are not in this PR.

How I validated

go test -short ./... passed. go test ./internal/vaultcluster passed (KeyStore, Raft health rule, S3 key/list, cron parse, plus existing isolation). go build ./cmd/vault-utils passed. Live Secrets Manager, KMS, S3, and a 3-node NLB were not run.

Review Note 1

Unit tests use in-memory fakes. bootstrap aws is not exercised against a real Vault with an AWS KMS seal. TestLocalComposeRuntime was not re-run (Docker Hub timeout). This branch does not change Compose.

Review Note 2

Review feedback applied in 5b50be0. AWS code moved out of internal/vaultcluster into internal/aws/secretsmanager and internal/aws/s3, so the shared package no longer imports the AWS SDK. Git recorded the Secrets Manager files as renames, which confirms the move carries no logic change. raftSnapshot is now exported as RaftSnapshot because the CLI composes the snapshot and the upload rather than calling a method on the Vault client. CLI help lists one line per subcommand and separates local from AWS environment variables. Go is 1.26 in go.mod, the Dockerfile, both workflows, and the README.

Three conventions changed inside the moved files. s3.New returns the concrete Store instead of the ObjectStore interface, the Secrets Manager interface is exported as SecretStore so the exported field is usable from outside the package, and the snapshot prefix default now lives in one helper instead of two copies.

validate and test-local both pass on 5b50be0. TestLocalComposeRuntime was re-run and passes on Go 1.26, which supersedes that line in Review Note 1. Live Secrets Manager, KMS, S3, and a 3-node NLB are still not covered.