ci: read the production env from Infisical and deploy on push

Each job logs in as the read-only spoon-ci machine identity and exports the Infisical prod environment, so production values no longer live in Gitea. After pushing the images, CI asks the VPS to redeploy podman-spoon.service over the forced-command deploy key, with the key passed through env so the printed script never contains it. Installs survive a half-written runner cache, and one production deploy runs at a time.

Infisical prod carries a valid JWKS; the copy in DOTENV_PROD had escaped quotes, so the Convex env sync had been serving invalid JSON at /.well-known/jwks.json. The first sync from Infisical replaces it.

scripts/ci-install

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Install on a runner, and survive a half-written cache entry.
+#
+# Runners have failed twice with "Fail extracting tarball" on a different
+# package each time, on different machines, and passed on a re-run. The cache
+# is shared between jobs on a host, so a job that dies mid-write leaves an
+# entry the next job cannot read. Clearing it and installing again costs a
+# couple of minutes; a human re-running the job costs however long it takes
+# someone to notice.
+set -euo pipefail
+if bun install --frozen-lockfile; then exit 0; fi
+echo "Install failed. Clearing the bun cache and trying once more." >&2
+rm -rf "${BUN_INSTALL_CACHE_DIR:-$HOME/.bun/install/cache}"
+bun install --frozen-lockfile