feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/core/app/secrets.go

@@ -0,0 +1,42 @@
+package app
+
+import (
+	"context"
+
+	"github.com/dtoro/oikos/internal/core/ports"
+)
+
+// SecretsService is the secrets use-case surface. get/list are direct
+// reads; Set is a direct write for the CLI/operator path — routing agent
+// writes through the approval flow (plan §3.4) lands with the governance
+// slice (PolicyService/ExecutionService), at which point the MCP
+// set_secret tool converges here too.
+type SecretsService struct {
+	backend ports.Secrets
+}
+
+// NewSecretsService wires the service over a secrets backend
+// (Infisical primary, SOPS DR fallback).
+func NewSecretsService(backend ports.Secrets) *SecretsService {
+	return &SecretsService{backend: backend}
+}
+
+// Get retrieves one secret value by key.
+func (s *SecretsService) Get(ctx context.Context, key string) (string, error) {
+	return s.backend.Get(ctx, key)
+}
+
+// List returns all secret keys (no values).
+func (s *SecretsService) List(ctx context.Context) ([]string, error) {
+	return s.backend.List(ctx)
+}
+
+// Set stores or updates a secret.
+func (s *SecretsService) Set(ctx context.Context, key, value string) error {
+	return s.backend.Set(ctx, key, value)
+}
+
+// Name reports the active backend (for diagnostics).
+func (s *SecretsService) Name() string {
+	return s.backend.Name()
+}