feat(staging): enable federation on persistent staging

social-federation rollout step 12.2 — inbound soak. Persistent staging
gets FEDERATION_ENABLED=true; PR previews keep the flag empty so
preview journals never emit federation traffic.

- docker-compose.staging.yml: journal accepts FEDERATION_ENABLED +
  FEDERATION_KEY_ENCRYPTION_KEY (both default empty).
- cd-staging.yml: persistent staging env sets FEDERATION_ENABLED=true;
  the encryption key arrives via the existing SOPS decryption.
- secrets.app.env: new FEDERATION_KEY_ENCRYPTION_KEY (SOPS-encrypted,
  generated with openssl rand -hex 32).

Production is unaffected: the flagship compose doesn't pass these vars
and the flag defaults off in code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/cd-staging.yml

@@ -127,6 +127,10 @@ jobs:
             echo "SENTRY_RELEASE=${{ github.sha }}"
             echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL"
             echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER"
+            # Federation soak on persistent staging only (social-federation
+            # rollout 12.2). FEDERATION_KEY_ENCRYPTION_KEY comes from the
+            # SOPS env decrypted above; previews never set this flag.
+            echo "FEDERATION_ENABLED=true"
           } >> infrastructure/staging.env
 
       - name: Copy compose file + env to server

infrastructure/docker-compose.staging.yml

@@ -61,6 +61,11 @@ services:
       WAHOO_CLIENT_SECRET: ""
       WAHOO_WEBHOOK_TOKEN: ""
       DEMO_BOT_ENABLED: ""
+      # Federation soak (social-federation rollout step 12.2). Enabled by
+      # cd-staging.yml for persistent staging only; PR previews leave both
+      # empty (flag off) so preview journals never emit federation traffic.
+      FEDERATION_ENABLED: ${FEDERATION_ENABLED:-}
+      FEDERATION_KEY_ENCRYPTION_KEY: ${FEDERATION_KEY_ENCRYPTION_KEY:-}
     healthcheck:
       test: ["CMD-SHELL", "curl -sf http://localhost:3000/api/health || exit 1"]
       interval: 15s

infrastructure/secrets.app.env

@@ -19,9 +19,10 @@ DEMO_BOT_RETENTION_DAYS=ENC[AES256_GCM,data:TBs=,iv:nSHXlED3C4CXGIPTZcNeB81FEtmL
 DEMO_BOT_REGION=ENC[AES256_GCM,data:fo5W9GNkYvCz5vx/OAISKzuXoIh5peNV3C73Z4aFIp+FCQ==,iv:THo3TcutFEdtBamnBxwS0SU3jYOmuAFdeoiOUxSVS4E=,tag:aoNkh4xIOr2dTW7UZeCPeA==,type:str]
 BROUTER_AUTH_TOKEN=ENC[AES256_GCM,data:U+oiuOkJQAO0LHIAlyjemObTL7hZlDS5XYdtFuWZx5ZWZodxVASeHYZAJXw=,iv:tHspZedPIpdPM4G7z/WlwtH/gLszgH/lS8DsKdtaYoc=,tag:BCfL7Qrr7GGQGQPIl+hZyQ==,type:str]
 BROUTER_URL=ENC[AES256_GCM,data:0ZB+DOVrJEiSrOdig0sea4fazkAT3Q==,iv:MoTSlxF8vqv/+FXUUpFlp/W3wedypcMwHwsc5uhruWA=,tag:Z+UpkmbsFM2D6l+hYcugpw==,type:str]
+FEDERATION_KEY_ENCRYPTION_KEY=ENC[AES256_GCM,data:XZU3Dqe6kZYko7beVSuMPEAghase1EfxSSMOk2JBZJjyuFPMvhCpvlP0EI6uR02G4JYiqOB+ocirmOIIC5BlSw==,iv:SQDVam6ZzooQrdDExNKLoJHoe7eX5G9NVkQhvZjWC/I=,tag:/AP4JNosAOqrYiOfG5mXUg==,type:str]
 sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqeDhnUTEzNDk5N1ZPSGFZ\nWjhFaEk3ZC9ackk4UTRaTFNuVkFnTmhXdEVZCnhjU0lFdHJ4dVpjSFYveFhFZmZN\neE0rMEZSNjBNU0RSeWloR2pYQmhlL0UKLS0tIGs5ZzVKbzN3WDBUQkZMSjBJQ0tr\nYkdBRHJra3daMVpSY1JIS2E3cHQyaG8Ky0cBnpRibgbX4famAtqxjc1oGvy5DuO9\nzk6zIQhM99XIoF7W/wn3JF6hPNSBOy7Bd7wVPUVVoE/uE0pIB+VSxQ==\n-----END AGE ENCRYPTED FILE-----\n
 sops_age__list_0__map_recipient=age1vukt8py0s2mm47fx6qh6vykckfkdqslf9w68ekytfzvc8xp7e3rqn6p64n
-sops_lastmodified=2026-05-23T19:05:37Z
-sops_mac=ENC[AES256_GCM,data:yxghS3UGqoKPi3PBPccezuGb/8KsyYGmZ2NVbx4/JNMvJTs/75E2u5H7IKcs77+zVpjT9rk0BoCGF5ryXQcpHgSuttVBvU5fLsg5OcyfkVEn09bbsV1Wf6pKqKzeZdPocVtnplyqbF4Bvha04Q4lsfKNSnVDwYnf9qs6w+A4WFo=,iv:mahufs1RVuAwHrrShCIYPgISbGaO3NJ38pYvu3v3Nn4=,tag:eYcDjvPajPcNin7BC+RqlA==,type:str]
+sops_lastmodified=2026-06-06T13:44:40Z
+sops_mac=ENC[AES256_GCM,data:QwwhtiVBfNb0LrEkJCR07UYxYuJ46fLnXAl5LnTAdeM1J4WdNrvBhAiKyUe0JGnvB6yMKqScf40fW6s9iEuobuTUYqeU+eiTzHh6MvhW5C9m95nrqBKtefIW+ji8pPS4BT9fjD0q2jOcBlSnRku2K2OKYsx9l+Sf6TZxT2V4EMY=,iv:r9fJyLyL24lYZmksv6VjZB9sVi0i6uZk0glAYzhBOBE=,tag:f+/0OfKsfvJMqUY79QbPKw==,type:str]
 sops_unencrypted_suffix=_unencrypted
 sops_version=3.12.2