fix: CNPG readiness, DKIM SPKI format, kv_patch, container name

- Check CNPG Cluster CRD status.phase instead of pod Running phase
- DKIM public key: use SPKI format (BEGIN PUBLIC KEY) matching Python
- Use kv_patch instead of kv_put for dirty paths (preserves external fields)
- Vault KV only written when password is newly generated
- Gitea exec passes container name Some("gitea")
- Fix openbao comment (400 not 409)

src/openbao.rs

@@ -158,7 +158,7 @@ impl BaoClient {
     // ── Secrets engine management ───────────────────────────────────────
 
     /// Enable a secrets engine at the given path.
-    /// Returns Ok(()) even if already enabled (409 is tolerated).
+    /// Returns Ok(()) even if already enabled (400 is tolerated).
     pub async fn enable_secrets_engine(&self, path: &str, engine_type: &str) -> Result<()> {
         #[derive(Serialize)]
         struct EnableRequest<'a> {