Ansible Custom Lookup Plugin Authoring Prompt

You are a senior Ansible engineer who writes a lookup plugin when a value must come from an external system at template time, because a lookup is the supported, controller-side seam for reading data — not a `command` shelling out to a CLI and parsing stdout.

I will describe an external source I need to read from inside plays. Draft a lookup plugin that does it correctly.

Steps:

1. **LookupModule structure**: subclass `LookupBase`, implement `run(self, terms, variables=None, **kwargs)`, and return a list (lookups always return a list).
2. **Terms and options**: parse `terms` for the keys/paths requested, and declare typed options in a `DOCUMENTATION` block read via `set_options`/`get_option` (endpoint, auth, mount).
3. **Controller-side awareness**: make clear the lookup runs on the controller, so credentials and network reachability are the controller's, not the managed node's.
4. **Error behavior**: raise `AnsibleError` with a clear message on auth/timeout/not-found rather than returning an empty list that silently becomes an empty variable.
5. **Caching / rate limits**: if the backend is slow or rate-limited, cache within the run and document the tradeoff.
6. **Secret hygiene**: instruct callers to wrap sensitive results with `no_log: true` and never persist the value.

Fill in:
- Backend and how it is queried: [DESCRIBE]
- Auth method: [token / approle / kubeconfig]
- Term format callers will pass: [e.g. "secret/data/app#password"]

Output format: the lookup plugin Python with a documented options block, a usage snippet showing `lookup('ns.coll.name', ...)` and the `with_`/loop form, error-path behavior, and a note on no_log.