Unify Vault request failure logs and metrics

[chet]

Vault request failures already increment a framework counter and then log the same failed operation separately. Centralizing those records in VaultRequestFailed gives every failure a correlated diagnostic while preserving expected credential misses as low-noise DEBUG events.

What this involves

• crates/secrets/src/forge_vault.rs: make record_vault_client_error emit both the existing failure metric and the applicable get/set/delete log.
• Use dynamic message/level behavior: credential 404 remains DEBUG; unexpected request failures retain their current ERROR wording.
• Preserve carbide_api_vault_requests_failed_total, request_type, and http_response_status_code exactly. Resource identifiers and errors remain context-only.
• Leave attempt, success, duration, and token-state telemetry unchanged.
• Extend current Vault metric tests to assert one failure increment and one correctly leveled log.

Part of #3169.