ci: read the production env from Infisical and deploy on push

Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time.

Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.

.infisical.json

@@ -1,5 +1,6 @@
 {
-  "workspaceId": "57f4b778-582f-49e2-89e1-5c7e6077facb",
-  "defaultEnvironment": "",
-  "gitBranchToEnvironmentMapping": null
+    "workspaceId": "57f4b778-582f-49e2-89e1-5c7e6077facb",
+    "defaultEnvironment": "",
+    "gitBranchToEnvironmentMapping": null,
+    "domain": "https://infisical.gbrown.org/api"
 }