Enforce TLS for Vault gRPC with developer-friendly certificate setup

[jh-lee-cryptolab]

Problem

Vault gRPC server currently uses plaintext communication (add_insecure_port / insecure_channel). Authentication tokens are transmitted unencrypted over the network, making them vulnerable to interception.

Current state

• Server: server.add_insecure_port() in mcp/vault/vault_grpc_server.py:180
• Client: grpc.aio.insecure_channel() in rune/mcp/adapter/vault_client.py:138
• Tokens sent in every gRPC request as plaintext fields
• Documentation claims TLS but it is not implemented

Requirements

Code changes

• vault_grpc_server.py: add_insecure_port → add_secure_port with ssl_server_credentials
• vault_client.py: insecure_channel → secure_channel with ssl_channel_credentials
• Add TLS cert/key path configuration via environment variables (VAULT_TLS_CERT, VAULT_TLS_KEY, VAULT_CA_CERT)
• Refuse to start in insecure mode unless VAULT_TLS_DISABLE=true is explicitly set (dev-only escape hatch)

Developer-friendly deployment

• Provide a generate-certs.sh script that generates self-signed CA + server cert with one command
• Update .env.example with TLS-related variables
• Update docker-compose.yml to mount cert volumes
• Update vault-deployment.yml with TLS secret mounts
• Clear step-by-step guide in vault/README.md

Affected files

• rune-admin/mcp/vault/vault_grpc_server.py
• rune/mcp/adapter/vault_client.py
• rune-admin/mcp/vault/.env.example
• rune-admin/mcp/vault/docker-compose.yml
• rune-admin/mcp/vault/vault-deployment.yml
• rune-admin/mcp/vault/README.md

Priority

Critical — This is the highest priority security gap. Without TLS, all other auth mechanisms (tokens, per-user permissions) are moot since credentials are exposed in transit.