Add unsealer, internal CA/TLS, auto-unseal, and automated cert+backup

Build out the home-lab OpenBAO deployment beyond the basic node:

- docker-compose: add openbao-unsealer sidecar; main node now transit
  auto-unseals against it (seal config kept in gitignored config/seal.hcl)
- policies/admin.hcl: non-root admin policy; per-engine rules for
  ssh/pki/pki_int/totp/transit
- Internal two-tier CA (pki/ root + pki_int/ intermediate) issues the
  openbao.famfi.home leaf Traefik serves; root CA published under ca/
- scripts/ + systemd/: daily cert renewal and Raft snapshot backups
  (both instances), with scoped tokens stored outside the repo
- README: full runbook (auto-unseal, PKI, renewal, backups, DR/restore)

Secrets (init/unsealer keys, tokens, seal stanza) stay gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config-unsealer/openbao.hcl

@@ -0,0 +1,19 @@
+ui = false
+
+# Tiny dedicated instance whose ONLY job is to hold a transit key that
+# auto-unseals the main OpenBAO node. It is itself Shamir-sealed (unsealed
+# manually or by a boot script). Keep its footprint minimal.
+storage "raft" {
+  path    = "/openbao/file"
+  node_id = "unsealer-node-1"
+}
+
+listener "tcp" {
+  address     = "0.0.0.0:8200"
+  tls_disable = 1
+}
+
+api_addr     = "http://openbao-unsealer:8200"
+cluster_addr = "https://openbao-unsealer:8201"
+
+# OpenBAO 2.x: no mlock; disable/encrypt host swap instead.