feat(kv): include KV v2 metadata (custom_metadata, version) in read_secret

[artfaal]

Problem

read_secret on a KV v2 mount returns only the data payload (secret.Data["data"]) and discards secret.Data["metadata"]. MCP clients therefore cannot see a secret's version, created/updated timestamps, or custom_metadata (e.g. description/usage) — even though Vault returns all of it in the same data-endpoint response.

Change

Return {"data": ..., "metadata": ...} for KV v2 reads, keeping the values while surfacing the metadata block. KV v1 behaviour is unchanged.

Why it matters

Teams often store human context (what a secret is for, where it's used) in custom_metadata. Without it an agent reading a secret has no idea what it is; this makes that context available.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

Max Solovev seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}