feat(openbao): add standalone deployment for swarm compatibility

- Create docker-compose.openbao.yml for standalone OpenBao deployment
  - Includes openbao and openbao-init services
  - Auto-initialization on first run
  - Connects to swarm's mosaic_internal network
  - Binds to localhost:8200 for security

- Update docker-compose.swarm.yml
  - Comment out OpenBao service (cannot run in swarm)
  - Add clear note about standalone requirement
  - Update volumes section
  - Update header with current config

- Create docs/OPENBAO-DEPLOYMENT.md
  - Comprehensive deployment guide
  - 4 deployment options: standalone, bundled, external, fallback
  - Clear explanation why OpenBao can't run in swarm
  - Deployment workflows for each scenario
  - Troubleshooting section

- Update docs/SWARM-DEPLOYMENT.md
  - Add Step 1: Deploy OpenBao standalone FIRST
  - Remove manual initialization (now automatic)
  - Update expected services list
  - Reference OpenBao deployment guide

- Update README.md
  - Clarify OpenBao standalone requirement for swarm
  - Update deployment steps
  - Highlight critical requirement at top of notes

Key changes:
- OpenBao MUST be deployed standalone when using swarm
- Automatic initialization via openbao-init sidecar
- Clear documentation for all deployment options
- Swarm stack no longer includes OpenBao

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -173,16 +173,18 @@ docker network create --driver=overlay traefik-public
 cp .env.swarm.example .env
 nano .env  # Configure domains, passwords, API keys
 
-# 4. Deploy stack
-./scripts/deploy-swarm.sh mosaic
+# 4. CRITICAL: Deploy OpenBao standalone FIRST
+# OpenBao cannot run in swarm mode - deploy as standalone container
+docker compose -f docker-compose.openbao.yml up -d
+sleep 30  # Wait for auto-initialization
 
-# 5. Check deployment status
+# 5. Deploy swarm stack
+IMAGE_TAG=dev ./scripts/deploy-swarm.sh mosaic
+
+# 6. Check deployment status
 docker stack services mosaic
 docker stack ps mosaic
 
-# 6. CRITICAL: Initialize OpenBao manually (see docs)
-# Unlike docker-compose, swarm requires manual OpenBao initialization
-
 # Access services via Traefik
 # Web:  http://mosaic.mosaicstack.dev
 # API:  http://api.mosaicstack.dev
@@ -200,9 +202,9 @@ docker stack ps mosaic
 
 **Important Notes:**
 
+- **OpenBao Requirement:** OpenBao MUST be deployed as standalone container (not in swarm). Use `docker-compose.openbao.yml` or external Vault.
 - Swarm does NOT support docker-compose profiles
 - To use external services (PostgreSQL, Authentik, etc.), manually comment them out in `docker-compose.swarm.yml`
-- OpenBao requires manual initialization (no auto-init sidecar in swarm mode)
 
 See [Docker Swarm Deployment Guide](docs/SWARM-DEPLOYMENT.md) and [Quick Reference](docs/SWARM-QUICKREF.md) for complete documentation.