A legacy service reads its database password from a local configuration file and cannot call Vault directly. Which capability can help?

1. Publishing Vault's storage backend publicly
2. Vault Agent templates rendering authorized secrets to a protected file
3. Disabling all token expiration globally
4. Replacing the password with the root token in the application source