fix(openbao-session): use a token role for entity-alias minting

entity-alias only works with -role; add OPENBAO_SESSION_ROLE so session tokens
can carry the user entity (and read humans/self) via the openbao-session role.
Bump 0.1.2.

Co-Authored-By: Claude <noreply@anthropic.com>

plugins/openbao-session/README.md

@@ -49,7 +49,13 @@ path "humans/metadata/{{identity.entity.id}}/*" { capabilities = ["read", "list"
 EOF
 bao policy write claude-session /tmp/claude-session.hcl
 
-# 3. Issue bootstrap token (TTL panjang, renewable) dan simpan NILAINYA ke secrets store LOKAL:
+# 3. Token roles (wajib utk -entity-alias). Perluas allowed_entity_aliases sesuai tim.
+bao write auth/token/roles/openbao-session \
+  allowed_policies=claude-session \
+  allowed_entity_aliases=adnan,rizal \
+  ttl=4h renewable=true
+
+# 4. Issue bootstrap token (TTL panjang, renewable) dan simpan NILAINYA ke secrets store LOKAL:
 bao token create -policy=openbao-session-creator -ttl=720h -renewable \
   -display-name=openbao-session-bootstrap -format=json
 #   → ambil auth.client_token, lalu di Mac Anda:
@@ -83,6 +89,7 @@ python3 ~/.config/devops-secrets/manage.py set openbao bootstrap_token --descrip
 | `OPENBAO_SESSION_POLICY` | `claude-session` | policy token sesi |
 | `OPENBAO_SESSION_TTL` | `4h` | umur token sesi |
 | `OPENBAO_SESSION_ENTITY` | *(kosong)* | nama entity OpenBao pemakai (mis. `adnan`, `rizal`) → token sesi diikat ke entity (aktifkan `humans/self`) |
+| `OPENBAO_SESSION_ROLE` | *(kosong)* | token role utk sesi (mis. `openbao-session`). Wajib diisi jika `OPENBAO_SESSION_ENTITY` diset (`-entity-alias` hanya bekerja dgn `-role`) |
 | `OPENBAO_SESSION_BAO_VER` | `2.6.2` | versi binary bao (auto-download jika belum ada) |
 | `OPENBAO_SESSION_SECRETS_HELPER` | `~/.config/devops-secrets/manage.py` | helper baca bootstrap |
 | `OPENBAO_SESSION_BOOTSTRAP_TOOL` / `_KEY` | `openbao` / `bootstrap_token` | lokasi bootstrap di secrets store |