适配 Bao 续期命令并纳入已验证的监控身份

infrastructure/openbao/ansible/roles/openbao_bootstrap/templates/bao-snapshot.sh.j2

@@ -11,7 +11,7 @@ BAO_TOKEN="$(cat /etc/openbao/snapshot.token)"
 export BAO_TOKEN
 
 # periodic token 不会自动续期；在每日快照前续期，避免 768h 后永久失败。
-bao token renew -self >/dev/null
+bao token renew >/dev/null
 
 dir="{{ openbao_snapshot_dir }}"
 stamp="$(date +%Y%m%d-%H%M%S)"

infrastructure/openbao/terraform/imports.tf

@@ -68,3 +68,14 @@ import {
   to = vault_pki_secret_backend_config_urls.this
   id = "pki/config/urls"
 }
+
+# 本次维护预检先通过同名 API 配置验证，后续 Terraform 纳入既有主 state。
+import {
+  to = vault_policy.metrics
+  id = "metrics"
+}
+
+import {
+  to = vault_kubernetes_auth_backend_role.metrics
+  id = "auth/kubernetes/role/metrics"
+}