#835 OPS: Vault at vault.rodmena.app is SEALED - tenant secrets API returns 500

EARS SPEC: - While Vault is sealed, the platform shall be considered degraded: /api/v1/tenant/secrets 500s (hvac VaultDown: 'Vault is sealed' on token lookup-self), vault-backed app secrets unreadable. - When Vault is unsealed by the operator, the tenant secrets endpoint shall return 200 and tests/integration/test_vault_secrets.py shall pass. Evidence: curl https://vault.rodmena.app/v1/sys/health -> sealed:true (2026-07-31). 84 identical tracebacks in api logs. Requires operator unseal keys - NOT fixable from this repo.