feat: wire Infisical secret store into API server and MCP tools

- Wire secretsManager in NewHandler() — instantiate InfisicalBackend
  when OIKOS_INFISICAL_SITE_URL is set (previously always nil)
- Add get_secret, list_secrets, set_secret MCP tools with nil-backend
  graceful degradation
- Add oikos secret get|set|list CLI subcommands for Infisical
- Fix Set() bug: create-before-update so new keys are created;
  add Type: "shared" to Update so it finds the right secret;
  disable SDK cache so Get returns fresh data after Set
- Clean enrollment response: remove fake infisical_client_id/
  infisical_client_secret stubs, store age key in Infisical for real

internal/httpapi/impl.go

@@ -1255,13 +1255,15 @@ func (s *Server) EnrollClient(ctx context.Context, req gen.EnrollClientRequestOb
 		return nil, err
 	}
 
-	infisicalClientID := "inf_client_" + uuid.NewString()
-	infisicalClientSecret := "inf_secret_" + uuid.NewString()
+	// Store age key in Infisical when backend is available.
+	if s.secretsManager != nil {
+		keyPath := "clients/" + req.Body.Slug + "/age-key"
+		_ = s.secretsManager.Set(ctx, keyPath, agePrivKey)
+	}
+
 	resp := gen.EnrollResponse{
-		AgePublicKey:          agePubKey,
-		AgePrivateKey:         agePrivKey,
-		InfisicalClientId:     infisicalClientID,
-		InfisicalClientSecret: infisicalClientSecret,
+		AgePublicKey:  agePubKey,
+		AgePrivateKey: agePrivKey,
 	}
 
 	return gen.EnrollClient200JSONResponse(resp), nil