- Add Python entrypoint.sh for Infisical secret injection
- Both backend and worker fetch DATABASE_URL, OPENAI_API_KEY from Infisical
- Worker uses network_mode:service:wireguard (shares traefik-public via WG)
- Keep env_file for non-secret config vars
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
