group_vars/test is incomplete — config renders fail on regluit-test

Found 2026-07-22 while deploying the #61 settings change: `setup-test.yml --tags config` (new playbook, mirrors setup-prod.yml) fails on the `prod.py.j2` render because `group_vars/test/` has only a 6-key `vars.yml` and **no `vault.yml`** — none of the template's required vars (`mysql_db_*`, `email_*`, `server_name`, `deploy_type`, …) are defined. Test's live `prod.py` has historically been hand-managed.

Interim: applied #61's exact delta by hand to test's rendered `prod.py` (backup at `prod.py.pre-1202-backup`); site + celery verified green.

Fix: build `group_vars/test/vars.yml` + vault-encrypted `vault.yml` from the test box's live rendered settings (per the staging-secrets-audit rule: audit each value for test-vs-prod fitness — no `sk_live`, no prod DB). Then test config renders become first-class like prod.

🤖 Filed by Claude Code.

Start with setup-test.yml --tags config, setup-prod.yml, group_vars/test/vars.yml, group_vars/test/vault.yml, and the prod.py.j2 render. Compare the test box's live prod.py values against the staging-secrets-audit rule and check each value for test suitability. Done means the test vars and encrypted vault exist and the config render completes successfully without using production secrets.

Written by the indexing model from the issue text.