feat: Add slcompose service orchestrator with Infisical secret injection

- Add slcompose.sh: Central orchestrator for managing all Docker services
  * Boot all services at startup with automated Infisical secret injection
  * Commands: up, down, restart, logs, logs-tail, env, env-all
  * Colored environment variable output (blue names, green values)

- Add slcompose.service: Systemd service file for auto-boot on startup
  * Type=oneshot with RemainAfterExit=yes
  * Waits for Docker service before starting
  * Runs on multi-user.target

- Add orchestration.md: Comprehensive documentation
  * Architecture and installation guide
  * Usage examples for all commands
  * Secret injection flow and troubleshooting
  * Performance and security notes

- Update README.md and AI_CONTEXT.md
  * Document service orchestration architecture
  * Explain slcompose functionality and commands
  * Reference new orchestration documentation

README.md

@@ -62,6 +62,49 @@ See [docs/roadmap.md](docs/roadmap.md) for the phased infrastructure roadmap.
 
 ---
 
+## Service Orchestration
+
+All Docker services on SilverLinux are managed through the **slcompose orchestrator** (`slcompose`), a bash wrapper that:
+
+1. **Injects Secrets** — Uses Infisical CLI to load environment variables from Infisical and inject them into each service at runtime
+2. **Boots All Services** — Automatically starts all services at system startup via systemd
+3. **Manages Services** — Provides CLI commands to start, stop, restart, and view logs for individual services
+
+### How It Works
+
+```bash
+# Load secrets from Infisical and start all services
+slcompose boot
+
+# Manage individual services
+slcompose up gitea              # Start gitea
+slcompose down gitea            # Stop gitea
+slcompose restart gitea         # Restart gitea
+slcompose logs gitea            # Stream live logs
+slcompose logs-tail gitea 200   # View last 200 lines
+slcompose list                  # List all services
+
+# View injected environment variables
+slcompose env gitea             # Show env vars for gitea
+slcompose env-all               # Show env vars for all services
+```
+
+**Service Auto-Boot:** The systemd service `slcompose.service` automatically runs `slcompose boot` on system startup, ensuring all services recover after server reboot.
+
+**Secrets Flow:**
+```
+System Boot → systemd slcompose.service → slcompose boot
+    ↓
+For each service in /srv/docker/:
+    - Load INFISICAL_TOKEN from /etc/infisical/token
+    - Use Infisical CLI to inject secrets from path: /[SERVICE_NAME]
+    - Run: docker compose up -d
+```
+
+See [docs/orchestration.md](docs/orchestration.md) and [docs/slcompose.sh](docs/slcompose.sh) for complete details.
+
+---
+
 ## Shared Infrastructure
 
 The following components are shared across multiple services:
@@ -73,13 +116,9 @@ The following components are shared across multiple services:
 * Isolated Docker Networks
 * Monitoring Docker Stack
 * Automated Backup System
-* Shared Secrets Management
+* Shared Secrets Management (Infisical + slcompose)
 
-Secrets are stored outside the repository:
-
-```text
-/srv/secrets/company.env
-```
+Secrets are managed centrally through Infisical and injected at runtime by the slcompose wrapper.
 
 ---