Add Vault auto-unseal service and 1Password bootstrap script

Add vault-tpm2-unseal.sh/.service to unseal Vault once after boot using
the TPM-sealed key, and tpm-bootstrap-1password.sh to (re)seal that key
from a 1Password secret reference. Document PCR policy selection, the
Vault service, and the host-specific tpm2.env (gitignored, example in
README) in README.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

vault-tpm2-unseal.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=Unseal HashiCorp Vault using a TPM 2.0 sealed key
+Documentation=file:/etc/vault.d/tpm2.env
+Requires=vault.service
+After=vault.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/etc/vault.d/tpm2.env
+ExecStart=/usr/local/sbin/vault-tpm2-unseal.sh
+
+[Install]
+WantedBy=vault.service