feat: Add slcompose service orchestrator with Infisical secret injection

- Add slcompose.sh: Central orchestrator for managing all Docker services
  * Boot all services at startup with automated Infisical secret injection
  * Commands: up, down, restart, logs, logs-tail, env, env-all
  * Colored environment variable output (blue names, green values)

- Add slcompose.service: Systemd service file for auto-boot on startup
  * Type=oneshot with RemainAfterExit=yes
  * Waits for Docker service before starting
  * Runs on multi-user.target

- Add orchestration.md: Comprehensive documentation
  * Architecture and installation guide
  * Usage examples for all commands
  * Secret injection flow and troubleshooting
  * Performance and security notes

- Update README.md and AI_CONTEXT.md
  * Document service orchestration architecture
  * Explain slcompose functionality and commands
  * Reference new orchestration documentation

mssql/README.md

@@ -39,10 +39,9 @@ Server-side administration must use `docker exec` or another container attached
 
 ## Secrets
 
-The SA password is stored outside the repository:
+The SA password is provided by Infisical at runtime:
 
 ```text
-/srv/secrets/company.env
 MSSQL_SA_PASSWORD
 ```
 
@@ -52,14 +51,14 @@ Never commit the value to Git or place it directly in the Compose file.
 
 ## Deployment
 
-Docker Compose must be given the secrets file for interpolation:
+The stack is deployed with Infisical injection instead of a local secrets file:
 
 ```bash
 cd /srv/docker/mssql
-docker compose --env-file /srv/secrets/company.env up -d
+infisical run --path=/ --recursive -- docker compose up -d
 ```
 
-The Compose `env_file:` setting passes variables into the container. It does not make them available while Compose resolves `${MSSQL_SA_PASSWORD}`, which is why `--env-file` is required.
+Secrets are injected into the environment before Docker Compose evaluates variables such as `${MSSQL_SA_PASSWORD}`.
 
 Validate startup:
 

mssql/docker-compose.yml

@@ -3,12 +3,11 @@ services:
     image: mcr.microsoft.com/mssql/server:2022-latest
     container_name: mssql
     restart: unless-stopped
-    env_file:
-      - /srv/secrets/company.env
+    # Secrets are injected by Infisical at runtime.
     environment:
       ACCEPT_EULA: Y
       MSSQL_PID: Express
-      MSSQL_SA_PASSWORD: ${MSSQL_SA_PASSWORD}
+      MSSQL_SA_PASSWORD: ''
     volumes:
       - /srv/docker/mssql/data:/var/opt/mssql
     networks: