Add smtp-healthcheck-ro policy (scoped read for ClaudeAdmin SMTP creds)

Read-only access to secret/data/smtp/healthcheck, consumed by the ClaudeAdmin
healthcheck email notifier via a periodic token.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

policies/smtp-healthcheck-ro.hcl

@@ -0,0 +1,6 @@
+# Read-only access to the SMTP credentials used by the ClaudeAdmin healthcheck
+# email notifier (run-healthcheck.sh). Scoped to exactly one KV v2 path.
+# Consumed via a periodic token at ~/.config/openbao/healthcheck-smtp.token.
+path "secret/data/smtp/healthcheck" {
+  capabilities = ["read"]
+}