Document the Vault-free runtime architecture

[Sinck]

This documents the target architecture for removing the NICo runtime dependency on Vault/OpenBao across credential storage, node API authentication, and the remaining key and certificate services. It keeps the completed subsystem designs authoritative while making the cross-epic dependencies explicit, so transitional states such as Transit-held KEKs and JWTs signed with the mTLS certificate key are not mistaken for the end state.

The design also records the manually installed fTPM certificate lifecycle as an open question and clarifies that a zero stale_remaining count covers live database rows only; old KEKs must remain available for retained backups and rollback windows.

Related issues

Closes #3251

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Additional Notes

Sections 1–7 describe the completed target architecture. Section 8 is a dated implementation snapshot that records intentional intermediate states between the three epics and points to the work that resolves each one. Detailed behavior for completed tasks remains in the linked subsystem design documents.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}