cleanup: archive stale secrets/ + secrets-issuance/, add Infisical bootstrap script, update SOPS paths to archive/

archive/secrets-issuance/deploy/webhook/install.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# First-time setup for the secrets-issuance deploy webhook. Generates a
+# secret, installs the systemd unit, and starts it.
+set -euo pipefail
+
+SECRET_DIR=/etc/secrets-issuance-deploy
+SECRET=$SECRET_DIR/secret
+UNIT=secrets-issuance-deploy.service
+
+install -d -m 700 "$SECRET_DIR"
+if [ ! -s "$SECRET" ]; then
+    head -c 32 /dev/urandom | base64 > "$SECRET"
+    chmod 600 "$SECRET"
+    echo "[install] generated webhook secret at $SECRET"
+fi
+
+systemctl daemon-reload
+systemctl enable --now "$UNIT"
+systemctl status "$UNIT" --no-pager | head -10
+
+cat <<EOF
+
+[install] webhook listening on :9821/deploy.
+Configure Gitea (dtoro/Homelab-Docs → Settings → Webhooks → Add Webhook → Gitea):
+  Target URL:   http://<lxc-105-mesh-ip>:9821/deploy
+  HTTP Method:  POST
+  Content-Type: application/json
+  Secret:       $(cat $SECRET)
+  Trigger:      Push events
+EOF