ci: read the production env from Infisical and deploy on push

Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time.

Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.

docs/server-deploy-changes.md

@@ -7,7 +7,7 @@ Most items have safe defaults; the **Required** ones are the only must-dos.
 ## Required
 
 1. **Build-time env for the Next image** — add to the build env file (the one CI /
-   `scripts/build-next-app` passes as build args; e.g. `DOTENV_PROD`):
+   `scripts/build-next-app` passes as build args, which CI reads from Infisical `prod`):
 
    ```
    NEXT_PUBLIC_SPOON_AGENT_WORKER_WS_URL=wss://worker.spoon.gbrown.org