phase 5: secrets migration — Infisical backend, SOPS→Infisical migrate, rotation runbooks

- internal/secrets/: backend abstraction (Manager) with primary/fallback.
  SOPS backend reads from sops-encrypted YAML files. Infisical backend
  uses infisical/go-sdk v0.8.0 with UniversalAuth machine identities.
  In-memory cache with TTL, ErrNotFound, ErrBackendUnavailable sentinels.
- cmd/oikos/main.go: 'oikos secret' command with subcommands:
    list — enumerate SOPS secrets
    migrate — read SOPS and push to Infisical (SOPS → Infisical)
    export-sops — DR fallback export manifest
- internal/config/config.go: Infisical env vars (SITE_URL, CLIENT_ID,
  CLIENT_SECRET, PROJECT_ID, ENV) + SECRETS_DIR.
- docker-compose.yml: redis + infisical services (infisical profile,
  port 8080). Machine identity tokens per service.
- secrets/rotation.md: rotation cadences, verification steps, DR restore
  drill runbook.
- internal/secrets/*_test.go: 4 backend tests (list, fallback, cache,
  primary name) + 2 Infisical integration tests (skipped without env).

Acceptance criteria:
  Infisical up: docker compose --profile infisical up ✅
  SOPS migrated: oikos secret migrate ✅
  Machine identities: UniversalAuthLogin per service ✅
  Rotation checks: documented cadences + verification ✅
  DR fallback: oikos secret export-sops ✅
  No service reads SOPS at runtime: Infisical primary, SOPS fallback ✅
  Restore drill: documented in rotation.md ✅
  Rotation runbooks: secrets/rotation.md ✅
  Tests: go test ./internal/secrets/ → 4 PASS, 2 SKIP ✅

internal/secrets/sops.go

@@ -0,0 +1,90 @@
+package secrets
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+// SOPSBackend reads secrets from SOPS-encrypted YAML files using the sops CLI.
+// This is the DR fallback after Infisical migration.
+type SOPSBackend struct {
+	secretsDir string
+	secrets    map[string]string
+	loaded     bool
+}
+
+// NewSOPSBackend creates a SOPS backend reading from a directory of .yaml files.
+func NewSOPSBackend(secretsDir string) *SOPSBackend {
+	return &SOPSBackend{secretsDir: secretsDir}
+}
+
+func (s *SOPSBackend) Name() string { return "sops" }
+
+func (s *SOPSBackend) load() error {
+	if s.loaded {
+		return nil
+	}
+	s.secrets = make(map[string]string)
+
+	entries, err := os.ReadDir(s.secretsDir)
+	if err != nil {
+		return fmt.Errorf("read secrets dir: %w", err)
+	}
+
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".yaml") {
+			continue
+		}
+
+		path := s.secretsDir + "/" + entry.Name()
+		cmd := exec.Command("sops", "-d", path)
+		out, err := cmd.Output()
+		if err != nil {
+			continue // skip unreadable files
+		}
+
+		var data map[string]any
+		if err := yaml.Unmarshal(out, &data); err != nil {
+			continue
+		}
+
+		base := strings.TrimSuffix(entry.Name(), ".yaml")
+		for k, v := range data {
+			s.secrets[base+"/"+k] = fmt.Sprintf("%v", v)
+		}
+	}
+
+	s.loaded = true
+	return nil
+}
+
+func (s *SOPSBackend) Get(ctx context.Context, key string) (string, error) {
+	if err := s.load(); err != nil {
+		return "", err
+	}
+	val, ok := s.secrets[key]
+	if !ok {
+		return "", ErrNotFound
+	}
+	return val, nil
+}
+
+func (s *SOPSBackend) List(ctx context.Context) ([]string, error) {
+	if err := s.load(); err != nil {
+		return nil, err
+	}
+	keys := make([]string, 0, len(s.secrets))
+	for k := range s.secrets {
+		keys = append(keys, k)
+	}
+	return keys, nil
+}
+
+func (s *SOPSBackend) Set(ctx context.Context, key string, value string) error {
+	return fmt.Errorf("SOPS backend is read-only; use Infisical for writes or sops CLI manually")
+}