release: v1.31.1 — sso v1.17.2 + /vault policy fix (setup.sh)

- bump sso-manager-node submodule gitlink v1.17.1 -> v1.17.2
  (post-deploy fixes: auto-slug plugins, schedule dropdown, /profile
  rendering, plugin-edit persistence, nmap in image, SMS/TOS on /conf,
  sso-side /vault policy grants)
- setup.sh: add sso-admin list grant on secret/metadata (KV mount root)
  so the /vault secrets list no longer 403s for admins
- setup.sh: ensure_policy now always (re)writes the policy so policy
  edits apply on a re-run instead of stranding the old HCL
- CHANGELOG embeds the full sso v1.17.2 changelog

Co-Authored-By: Claude <noreply@anthropic.com>

setup.sh

@@ -712,12 +712,12 @@ bao_run() { docker exec -e BAO_TOKEN="$VAULT_TOKEN" openbao bao "$@"; }
 # Write an ACL policy from stdin HCL only if it does not already exist.
 ensure_policy() {
 	local name="$1"
-	if bao_run policy read "$name" >/dev/null 2>&1; then
-		info "  policy ${name} already exists — keeping."
-	else
-		info "  writing policy ${name}..."
-		docker exec -i -e BAO_TOKEN="$VAULT_TOKEN" openbao bao policy write "$name" - >/dev/null
-	fi
+	# Always (re)write: `bao policy write` is an idempotent overwrite, so this
+	# applies policy edits on a re-run instead of stranding the old HCL
+	# forever ("already exists — keeping" silently dropped upgrades — e.g.
+	# the secret/metadata mount-root list grant added for the /vault fix).
+	info "  writing policy ${name}..."
+	docker exec -i -e BAO_TOKEN="$VAULT_TOKEN" openbao bao policy write "$name" - >/dev/null
 }
 
 # Read KEY= from ./.env (empty if absent) — reuse a previously minted token
@@ -787,8 +787,12 @@ path "sys/policies/acl/app-*" { capabilities = ["create", "read", "update", "del
 path "sys/policies/acl/sso-admin" { capabilities = ["create", "read", "update", "delete", "list"] }
 HCL
 # sso-admin — admin users in the vault UI: read/write/list everything under secret/.
+# The bare `secret/metadata` grant lets an admin LIST the KV mount root (the
+# top-level dirs); `secret/metadata/*` covers nested paths but not the root
+# itself, so without it the /vault secrets list 403s.
 ensure_policy sso-admin <<'HCL'
 path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
+path "secret/metadata" { capabilities = ["list", "read", "delete"] }
 path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }
 HCL
 # proxy / jump-host — read only their own boot conf.