feat: wire Infisical secret store into API server and MCP tools

- Wire secretsManager in NewHandler() — instantiate InfisicalBackend
  when OIKOS_INFISICAL_SITE_URL is set (previously always nil)
- Add get_secret, list_secrets, set_secret MCP tools with nil-backend
  graceful degradation
- Add oikos secret get|set|list CLI subcommands for Infisical
- Fix Set() bug: create-before-update so new keys are created;
  add Type: "shared" to Update so it finds the right secret;
  disable SDK cache so Get returns fresh data after Set
- Clean enrollment response: remove fake infisical_client_id/
  infisical_client_secret stubs, store age key in Infisical for real

internal/mcp/server_test.go

@@ -86,7 +86,7 @@ func TestNewServerRegistersTools(t *testing.T) {
 	}()
 	// pool is only used inside tool handlers (invoked per-call), not at
 	// registration time, so a nil pool is safe for this construction test.
-	s := newServer(nil, uuid.Nil)
+	s := newServer(nil, uuid.Nil, nil)
 	if s == nil {
 		t.Fatal("newServer returned nil")
 	}