feat(deploy): Faza A Infisical runtime migration

Stripped 35-var environment block from docker-compose.yml to 5 bootstrap
vars (INFISICAL_CLIENT_ID/SECRET, NODE_ENV, PORT, HOSTNAME). All app
secrets now fetched from Infisical /architools at container boot via
docker-entrypoint.sh (modeled on gis-api's pattern, INFISICAL_APP_PATH
=/architools).

- docker-entrypoint.sh: universal-auth login, fetch /architools + /
  root, expand ${/VAR} refs, export, exec CMD. Fails loud on Infisical
  unreachable (exit 2/3).
- Dockerfile runner: added curl+jq, COPY entrypoint + chmod +x,
  ENTRYPOINT ["/app/docker-entrypoint.sh"]
- compose: build args (NEXT_PUBLIC_*) preserved — build-time inlining
  into JS bundle. martin/tile-cache/tippecanoe service env blocks
  untouched (legacy, removed in Faza E).

Rotation workflow now: Infisical UI -> ssh satra "cd /opt/architools && docker compose up -d --force-recreate architools". Never docker compose restart (does not refetch).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -13,68 +13,12 @@ services:
     ports:
       - "3000:3000"
     environment:
-      - NODE_ENV=${NODE_ENV}
-      # Database
-      - DATABASE_URL=${DATABASE_URL}
-      # MinIO
-      - MINIO_ENDPOINT=${MINIO_ENDPOINT}
-      - MINIO_PORT=${MINIO_PORT}
-      - MINIO_USE_SSL=${MINIO_USE_SSL}
-      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
-      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
-      - MINIO_BUCKET_NAME=${MINIO_BUCKET_NAME}
-      # Authentication (Authentik OIDC)
-      - NEXTAUTH_URL=${NEXTAUTH_URL}
-      - NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
-      - AUTHENTIK_CLIENT_ID=${AUTHENTIK_CLIENT_ID}
-      - AUTHENTIK_CLIENT_SECRET=${AUTHENTIK_CLIENT_SECRET}
-      - AUTHENTIK_ISSUER=${AUTHENTIK_ISSUER}
-      # Vault encryption
-      - ENCRYPTION_SECRET=${ENCRYPTION_SECRET}
-      # ManicTime Tags.txt sync (SMB mount path)
-      - MANICTIME_TAGS_PATH=${MANICTIME_TAGS_PATH}
-      # AI Chat (set AI_PROVIDER to openai/anthropic/ollama; demo if no key)
-      - AI_PROVIDER=${AI_PROVIDER:-demo}
-      - AI_API_KEY=${AI_API_KEY:-}
-      - AI_MODEL=${AI_MODEL:-}
-      - AI_BASE_URL=${AI_BASE_URL:-}
-      - AI_MAX_TOKENS=${AI_MAX_TOKENS:-2048}
-      # Visual CoPilot (at-vim)
-      - VIM_URL=${VIM_URL:-}
-      # eTerra ANCPI (parcel-sync module)
-      - ETERRA_USERNAME=${ETERRA_USERNAME:-}
-      - ETERRA_PASSWORD=${ETERRA_PASSWORD:-}
-      # ANCPI ePay (CF extract ordering)
-      - ANCPI_USERNAME=${ANCPI_USERNAME}
-      - ANCPI_PASSWORD=${ANCPI_PASSWORD}
-      - ANCPI_BASE_URL=${ANCPI_BASE_URL}
-      - ANCPI_LOGIN_URL=${ANCPI_LOGIN_URL}
-      - ANCPI_DEFAULT_SOLICITANT_ID=${ANCPI_DEFAULT_SOLICITANT_ID}
-      - MINIO_BUCKET_ANCPI=${MINIO_BUCKET_ANCPI}
-      # Stirling PDF (local PDF tools)
-      - STIRLING_PDF_URL=${STIRLING_PDF_URL}
-      - STIRLING_PDF_API_KEY=${STIRLING_PDF_API_KEY}
-      # iLovePDF cloud compression (free: 250 files/month)
-      - ILOVEPDF_PUBLIC_KEY=${ILOVEPDF_PUBLIC_KEY:-}
-      # Martin vector tile server (geoportal)
-      - NEXT_PUBLIC_MARTIN_URL=${NEXT_PUBLIC_MARTIN_URL}
-      # PMTiles overview tiles — proxied through tile-cache nginx (HTTPS, no mixed-content)
-      - NEXT_PUBLIC_PMTILES_URL=${NEXT_PUBLIC_PMTILES_URL}
-      # DWG-to-DXF sidecar
-      - DWG2DXF_URL=${DWG2DXF_URL}
-      # Email notifications (Brevo REST API)
-      - BREVO_API_KEY=${BREVO_API_KEY}
-      - NOTIFICATION_FROM_EMAIL=${NOTIFICATION_FROM_EMAIL}
-      - NOTIFICATION_FROM_NAME=${NOTIFICATION_FROM_NAME}
-      - NOTIFICATION_CRON_SECRET=${NOTIFICATION_CRON_SECRET}
-      # Weekend Deep Sync email reports (comma-separated for multiple recipients)
-      - WEEKEND_SYNC_EMAIL=${WEEKEND_SYNC_EMAIL:-}
-      # PMTiles rebuild webhook (pmtiles-webhook systemd service on host)
-      - N8N_WEBHOOK_URL=${N8N_WEBHOOK_URL:-http://10.10.10.166:9876}
-      # Portal-only users (comma-separated, redirected to /portal)
-      - PORTAL_ONLY_USERS=${PORTAL_ONLY_USERS}
-      # Address Book API (inter-service auth for external tools)
-      - ADDRESSBOOK_API_KEY=${ADDRESSBOOK_API_KEY}
+      # Infisical runtime bootstrap (all app secrets fetched from /architools at boot via docker-entrypoint.sh)
+      - INFISICAL_CLIENT_ID=${INFISICAL_CLIENT_ID}
+      - INFISICAL_CLIENT_SECRET=${INFISICAL_CLIENT_SECRET}
+      - NODE_ENV=${NODE_ENV:-production}
+      - PORT=3000
+      - HOSTNAME=0.0.0.0
     depends_on:
       dwg2dxf:
         condition: service_healthy