Add vault client initialization check

Make a request when creating the client to see if the Vault
is unsealed and available for operation.

cmd/signer/main.go

@@ -52,7 +52,7 @@ func main() {
 
 	vault, err := vault.New(cfg.Vault.Addr, cfg.Vault.Token, httpClient)
 	if err != nil {
-		logger.Fatal("cannot create vault client", zap.Error(err))
+		logger.Fatal("cannot initialize vault client", zap.Error(err))
 	}
 
 	// create services

internal/clients/vault/client.go

@@ -35,6 +35,10 @@ func New(addr string, token string, httpClient *http.Client) (*Client, error) {
 
 	client.SetToken(token)
 
+	if _, err = client.Sys().Capabilities(token, pathSign); err != nil {
+		return nil, err
+	}
+
 	return &Client{cfg: cfg, client: client}, nil
 }