feat(vault): background poller for canary reads + access logs

[LiorFink00]

What

Closes the vault loop (Task 6 of the secret-manager migration, epic #255). A background poller checks each configured secrets manager's audit log for reads of planted canary secrets and alerts on them.

• CanaryAccessLog table + migration canary_access_logs_v1 (chained off vault_tables_v1), with a (canary_secret_id, event_id) uniqueness key.
• store.record_canary_access (deduped by the manager's event id) + list_canary_access_logs.
• services/vault_poller.py — poll_once() + an asyncio interval loop, started from the app lifespan and cancelled on shutdown (try/finally). Interval via THUMPER_VAULT_POLL_INTERVAL (default 30s).
• GET /api/vault/secrets/{csid}/access-logs to surface recorded reads in the UI (Task 7).

Notable deviation from the enterprise original

Dedup happens before alerting (the enterprise version alerted, then recorded). The AWS plugin polls CloudTrail with a ~20-min lookback window, so the same read re-surfaces on overlapping poll cycles; recording first means a single read alerts exactly once. Covered by test_poll_once_dedupes_repeated_event.

Also

Drops a pre-existing unused import json in tests/test_vault_api.py that was failing lint on the base branch (#262).

Testing

• test_vault_poller.py (8): no-connections, no-secrets, detect-read, dedup, skip-unconfigured, continue-on-plugin-error, survive-poll-failure.
• test_vault_store.py (+4): record / dedup-by-event-id / no-event-id-not-deduped / newest-first.
• test_vault_api.py (+2): access-logs 404 + list.
• Full local suite green except the known atime flake (test(agent): de-flake the atime tests (read-before-baseline race) #233) and the boto3/hvac-gated plugin tests (deps present in CI). Migration single-head verified; ruff clean.

Stacked

Based on #262 → #261 → #260 → #259 → #257. Merge those first; this rebases to just the poller.

🤖 Generated with Claude Code