feat: integrate managed secret synchronization

[mkmidex-001]

Summary

• Add External Secrets Operator resources to sync the AWS Secrets Manager secret into the Kubernetes backend secret.
• Document least-privilege IAM/IRSA, CloudTrail auditability, rotation, rollout, and incident response.
• Remove hard-coded database/JWT credentials from Compose and document required environment values.
• Repair the legacy config shim to use the current validated config API.

Verification

• Focused config tests: 5 passed; config warning/serialization tests: 9 passed.
• Docker Compose config and YAML validation passed.
• Full config boot is blocked by pre-existing Prisma schema relation errors (P1012), unrelated to this change.
• AWS account/IRSA deployment and actual secret rotation were not run in this environment.

Fixes #75

[drips-wave]

@mkmidex-001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[mkmidex-001]

@Dorisio @mkmidex-001 I pushed the #75 fix in commit 8f89616db0a57de95c40c9c66fa8f36faea2f173 and opened this PR against upstream main. It adds AWS Secrets Manager → External Secrets Operator synchronization and operational guidance for least-privilege IAM/IRSA, audit, and rotation; removes hard-coded Compose credentials; and repairs the legacy config shim. Focused config tests (5 + 9), Compose config, and YAML validation passed. Full config boot remains blocked by existing Prisma schema relation errors (P1012); AWS-side deployment/rotation was not exercised. Please review and run CI.

[heymariam]

@mkmidex-001 well done and thanks for contributing, resolve the conflicts so we can check and merge