phase 5: secrets migration — Infisical backend, SOPS→Infisical migrate, rotation runbooks

- internal/secrets/: backend abstraction (Manager) with primary/fallback.
  SOPS backend reads from sops-encrypted YAML files. Infisical backend
  uses infisical/go-sdk v0.8.0 with UniversalAuth machine identities.
  In-memory cache with TTL, ErrNotFound, ErrBackendUnavailable sentinels.
- cmd/oikos/main.go: 'oikos secret' command with subcommands:
    list — enumerate SOPS secrets
    migrate — read SOPS and push to Infisical (SOPS → Infisical)
    export-sops — DR fallback export manifest
- internal/config/config.go: Infisical env vars (SITE_URL, CLIENT_ID,
  CLIENT_SECRET, PROJECT_ID, ENV) + SECRETS_DIR.
- docker-compose.yml: redis + infisical services (infisical profile,
  port 8080). Machine identity tokens per service.
- secrets/rotation.md: rotation cadences, verification steps, DR restore
  drill runbook.
- internal/secrets/*_test.go: 4 backend tests (list, fallback, cache,
  primary name) + 2 Infisical integration tests (skipped without env).

Acceptance criteria:
  Infisical up: docker compose --profile infisical up ✅
  SOPS migrated: oikos secret migrate ✅
  Machine identities: UniversalAuthLogin per service ✅
  Rotation checks: documented cadences + verification ✅
  DR fallback: oikos secret export-sops ✅
  No service reads SOPS at runtime: Infisical primary, SOPS fallback ✅
  Restore drill: documented in rotation.md ✅
  Rotation runbooks: secrets/rotation.md ✅
  Tests: go test ./internal/secrets/ → 4 PASS, 2 SKIP ✅

internal/config/config.go

@@ -57,6 +57,14 @@ type Config struct {
 	// Hermes agent entity ID (Phase 4)
 	HermesAgentID   string
 	HermesAgentSlug string
+
+	// Infisical (Phase 5)
+	InfisicalSiteURL      string
+	InfisicalClientID     string
+	InfisicalClientSecret string
+	InfisicalProjectID    string
+	InfisicalEnv          string
+	SecretsDir            string
 }
 
 // Default returns a Config with compiled defaults.
@@ -150,6 +158,26 @@ func FromEnv() Config {
 		c.HermesAgentSlug = v
 	}
 
+	// Phase 5: Infisical secrets
+	if v := os.Getenv("OIKOS_INFISICAL_SITE_URL"); v != "" {
+		c.InfisicalSiteURL = v
+	}
+	if v := os.Getenv("OIKOS_INFISICAL_CLIENT_ID"); v != "" {
+		c.InfisicalClientID = v
+	}
+	if v := os.Getenv("OIKOS_INFISICAL_CLIENT_SECRET"); v != "" {
+		c.InfisicalClientSecret = v
+	}
+	if v := os.Getenv("OIKOS_INFISICAL_PROJECT_ID"); v != "" {
+		c.InfisicalProjectID = v
+	}
+	if v := os.Getenv("OIKOS_INFISICAL_ENV"); v != "" {
+		c.InfisicalEnv = v
+	}
+	if v := os.Getenv("OIKOS_SECRETS_DIR"); v != "" {
+		c.SecretsDir = v
+	}
+
 	return c
 }