Add the mesh-vault module; redis takes its password from it

mesh-vault provides `secret` (novox/hq ADR 0085, design 24). The value is
the pair credential the controller mints — the vault holds no copy, only a
ledger of who holds one, its fingerprint and every rotation, and two tools that
answer by fingerprint and never by value. Rotation is `rotate secret`,
unchanged machinery pointed at a secret with an owner (design 13). Named in the
mesh's own namespace, beside mesh-controller and mesh-catalog, because it is
the mesh's own code rather than wrapped software.

redis is the first consumer: its own password stops being an own-secret nothing
could rotate and becomes a `secret` it requires, read from the same file into
the same hole. The server now restarts on its config, or it would keep the
password it started with through every rotation (playbook 06).

modules/lavinmq/module.json

@@ -36,6 +36,7 @@
     "amqp": "/var/lib/lavinmq-module/grants"
   },
   "own-secrets": {
+    "admin": "/var/lib/lavinmq-module/admin.secret",
     "broker": "/var/lib/mesh/lavinmq/broker"
   },
   "listens": [
@@ -99,14 +100,15 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
-        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro"
+        "/var/lib/lavinmq-module/grants:/var/lib/lavinmq-module/grants:ro",
+        "/var/lib/lavinmq-module/admin.secret:/run/secrets/admin:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_RECEIVES": "/var/lib/lavinmq-module/grants/mesh.json",
         "MESH_PROVISION_LAVINMQ": "http://127.0.0.1:15672",
         "MESH_PROVISION_ADMIN_USER": "guest",
-        "MESH_LAVINMQ_ADMIN_PASSWORD": "guest"
+        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/admin"
       }
     }
   ],