Vault Agent writes secrets into memory

Secrets live in Vault, at secret/data/apps/titikterang. The app container reads a file the agent writes to /vault/secrets.

The app waits until the agent is healthy. The RoleID and wrap token sit in a host directory that is read-only, not in the image and not in compose.

Do not write a password into Dockerfile.app. If that file leaks, the secret leaks with it.