cleanup: archive stale secrets/ + secrets-issuance/, add Infisical bootstrap script, update SOPS paths to archive/

archive/secrets-issuance/server.service

@@ -0,0 +1,23 @@
+[Unit]
+Description=Homelab secrets-issuance (per-client age key provisioning)
+After=network-online.target homelab-context-sync.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/secrets-issuance
+Environment=HOMELAB_CONTEXT_DIR=/opt/homelab-context
+Environment=SECRETS_ISSUANCE_STATE=/var/lib/secrets-issuance
+Environment=MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10,192.168.8.0/24
+ExecStart=/opt/secrets-issuance/.venv/bin/python /opt/secrets-issuance/secrets-issuance/server.py
+Restart=on-failure
+RestartSec=5
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+NoNewPrivileges=true
+ReadOnlyPaths=/opt/homelab-context /opt/secrets-issuance
+ReadWritePaths=/var/lib/secrets-issuance
+
+[Install]
+WantedBy=multi-user.target