Assume the role of a Fortinet-certified SD-WAN Network Architect (FCSS level or equivalent).

Your task is to generate a comprehensive FortiOS CLI configuration template for a **Spoke** device participating in a secure SD-WAN deployment with multi-VRF segmentation.

**Architecture Requirements:**

1.  **Topology:** Standard Hub-and-Spoke connecting to **two redundant Hubs (Hub-A, Hub-B)** for resilience. **Crucially, ADVPN (Auto-Discovery VPN) must be disabled.** All Spoke-to-Spoke communication must route via one of the Hubs.
2.  **Segmentation:** Implement multi-VRF segmentation. Include:
    * One **Transport VRF** (VRF 1) for WAN interfaces, overlay tunnels, and BGP peering.
    * Four **User VRFs**:
        * VRF 10 (Corporate Data)
        * VRF 20 (VoIP)
        * VRF 70 (Guest WiFi)
        * VRF 100 (Local Servers)
3.  **Inter-VRF Communication:** Utilize **VDOM Links** and **BGP Route Leaking** (`config leak-target`) controlled by **Route Maps** and **Prefix Lists** to manage communication between the Transport VRF (VRF 1) and the User VRFs (10, 20, 70, 100). Primarily leak default route from VRF 1 to User VRFs, and leak specific connected LAN subnets from User VRFs to VRF 1.
4.  **Overlay:** Use **IPsec IKEv2** tunnels established over **two** WAN underlay interfaces (e.g., INET and MPLS). Use **PSK** for authentication (separate PSK per Hub/Underlay combination for security). Ensure **`vpn-id-ipip` encapsulation** is enabled on Phase 1 for VRF context transport. A total of four tunnels will be configured (INET->HubA, INET->HubB, MPLS->HubA, MPLS->HubB).
5.  **Routing:**
    * Use **iBGP** as the overlay routing protocol running within the Transport VRF (VRF 1).
    * Peering should be established between the Spoke's **Loopback interface** (in VRF 1) and the Loopback interfaces of **both Hubs** (Hub-A and Hub-B).
    * Utilize **BGP VPNv4** address family for exchanging routes between VRFs.
    * Configure **redistribution** ('connected') within each User VRF (10, 20, 70, 100) using specific Route Maps to advertise only the local LAN subnets into BGP (leaked to VRF 1). Redistribute the Spoke's Loopback in VRF 1.
    * Include necessary **static routes**: Default routes in User VRFs pointing to VRF 1 via VDOM Links, default routes in VRF 1 pointing to WAN gateways (if static IPs used, otherwise DHCP handles this), routes for VDOM Link subnets in VRF 1, and blackhole routes for RFC1918 in User VRFs and VRF 1.
6.  **SD-WAN:** Include `config system sdwan` on the Spoke (in VRF 1).
    * **Members:** Define members for both WAN underlays (INET, MPLS) and all four overlay tunnels.
    * **Zones:** Define appropriate SD-WAN zones (e.g., UNDERLAY_INET, UNDERLAY_MPLS, OVERLAY_HUBA, OVERLAY_HUBB).
    * **Health Checks:** Configure health checks (ping) targeting the Loopback IPs of Hub-A and Hub-B over the overlay tunnels, and at least one health check for general Internet connectivity (e.g., ping 8.8.8.8) over the underlays. Define appropriate SLAs.
    * **Rules:** Implement SD-WAN rules to steer traffic:
        * Corp Data (VRF 10 Source) -> Prefer Hub-A Overlays (based on SLA), failover to Hub-B Overlays.
        * VoIP (VRF 20 Source) -> Prefer Overlay tunnel (any Hub) with lowest jitter (based on SLA).
        * Guest WiFi (VRF 70 Source) -> Direct Internet Access (DIA) via INET underlay, failover to MPLS underlay (if allowed, otherwise block). Use `priority` mode.
        * Local Servers (VRF 100 Source) -> Prefer Hub-B Overlays (based on SLA), failover to Hub-A Overlays.
        * Default Rule -> Use best Overlay tunnel (any Hub) based on SLA (e.g., latency/loss).
7.  **Firewall:** Include necessary firewall objects (addresses for local LANs, Hub/Spoke Loopbacks, RFC1918; groups for LANs, Hub Loopbacks, Overlay Zones; ippools for NAT). Policies must be **VRF-aware** (`set vrf <id>`) and cover essential flows:
    * LAN -> VDOM Link (per User VRF).
    * VDOM Link -> VDOM Link (Inter-VRF Leak policies).
    * VDOM Link (from User VRF via VRF 1) -> Overlay Zones (per User VRF context, controlled by routing).
    * Overlay Zones -> VDOM Link (towards User VRF via VRF 1).
    * Guest WiFi (VRF 70 via VRF 1) -> WAN Underlay for DIA (with NAT).
    * Management access policy allowing Hub Loopbacks to access Spoke Loopback (in VRF 1).

**Template Requirements:**

1.  **Placeholders:** Use placeholder variables in the format `$(VARIABLE_NAME)` for all site-specific values (e.g., `$(SPOKE_HOSTNAME)`, `$(WAN_INET_IP)`, `$(LAN_VRF10_PREFIX)`, `$(PSK_HUBA_INET)`, `$(BGP_AS)`).
2.  **Variable List:** Include a commented section `== VARIABLES ==` at the beginning of the template listing all the placeholders used.
3.  **Structure:** Organize the configuration logically by section (e.g., System, Interfaces, VDOM Links, Static Routes, VPN, BGP, SD-WAN, Firewall Objects, Firewall Policies).
4.  **Comments:** Add clear comments explaining the purpose of each configuration block and key commands, especially those related to VRF, leaking, VPNv4, and SD-WAN rules.
5.  **Format:** Output must be in FortiOS CLI format.

Generate the template for the **Spoke** role based on these requirements.