RDS master (root) password: nobody has it — OK to rotate + store?

## Ask (for @eshellman)
Does anyone hold the RDS **master (`root`) password** for `production-2024` / `production-2024-old1` / `test-2026-08-23`? If not — **OK to rotate it** and store the new one (1Password + an ansible-vault variable)? Rotation is `modify-db-instance --master-user-password --apply-immediately`: no restart, no downtime, the `regluit` app user is untouched. The only effect is that the *old* root password stops working — so I want to hear from you before doing it.

## Why now
Prepping the by-hand index migration for 2026-09-15 09:00 (PR #73, W1), the pre-check found the app user `regluit` has **no `PROCESS` privilege and no `mysql.rds_kill_query`** — it can't see or kill another session's blocked query. Tomorrow proceeds anyway on the app user with a 10 s `lock_wait_timeout` guard (online DDL, fails harmlessly). But every future DDL / restore / blue-green window wants a master session, and right now none of us can open one: the password is not AWS-managed, not in the vault (`vault_mysql_db_*` is the app user), not in the repos, and the one candidate RY found was refused (2026-09-14 17:08, one failed login from the prod box — that was RY).

## Plan once OK'd
1. RY generates a strong password, stores it in 1Password (shared with Eric), runs the rotation, verifies `SHOW GRANTS` shows `PROCESS` from the prod box.
2. Add `vault_mysql_root_pass` (and `vault_mysql_root_user: root`) to `group_vars/production/vault.yml` so playbooks (e.g. a future `migrate.yml` with a pre-flight `SHOW PROCESSLIST`, or the monthly test rebuild) can use it. Same for test.
3. Note the rotation in the Operator Playbook (README for Eric).
4. Longer-term: see the secrets-manager issue (linked below) — the vault is accumulating credentials.

Agenda item for Thu 2026-09-17 10:00 as well.

Start with the rotation procedure in the issue, then inspect group_vars/production/vault.yml and the Operator Playbook README. Check the referenced PR #73 and the linked secrets-manager work before changing production credentials. Done means approval is recorded, the master password is stored as described, SHOW GRANTS is verified, and the rotation is documented.

Written by the indexing model from the issue text.