SOPS+age secrets, split CD workflows, GitHub OAuth for Grafana

Secrets:
- Add .sops.yaml with age encryption config
- Add encrypted secrets.app.env (app secrets) and secrets.infra.env (Grafana OAuth)
- CD decrypts at deploy time with AGE_SECRET_KEY — all other secrets
  move out of GitHub Actions into version-controlled encrypted files

Split CD:
- cd-apps.yml: triggered by apps/packages changes, builds Docker images, deploys apps
- cd-infra.yml: triggered by infrastructure/ changes, copies configs, restarts services
- Remove monolithic cd.yml

Grafana auth:
- GitHub OAuth (trails-cool org), disable login form
- Remove Caddy basic_auth block and all GRAFANA_* env vars/secrets

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/cd-brouter.yml

@@ -0,0 +1,66 @@
+name: CD BRouter
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docker/brouter/**"
+  workflow_dispatch: {}
+
+concurrency:
+  group: deploy-brouter
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build & Push BRouter Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v7
+        with:
+          context: docker/brouter
+          push: true
+          tags: |
+            ghcr.io/trails-cool/brouter:latest
+            ghcr.io/trails-cool/brouter:${{ github.sha }}
+
+  deploy:
+    name: Deploy BRouter
+    needs: [build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: root
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            cd /opt/trails-cool
+
+            # Download BRouter segments if missing
+            if [ ! -d /opt/trails-cool/segments ] || [ -z "$(ls /opt/trails-cool/segments/*.rd5 2>/dev/null)" ]; then
+              mkdir -p /opt/trails-cool/segments
+              echo "Downloading Germany BRouter segments..."
+              for tile in E5_N45 E5_N50 E10_N45 E10_N50; do
+                [ -f "/opt/trails-cool/segments/${tile}.rd5" ] || \
+                  wget -q "https://brouter.de/brouter/segments4/${tile}.rd5" -O "/opt/trails-cool/segments/${tile}.rd5"
+              done
+            fi
+
+            docker pull ghcr.io/trails-cool/brouter:latest
+            docker compose up -d brouter
+            docker image prune -af