feat(staging): enable federation on persistent staging

social-federation rollout step 12.2 — inbound soak. Persistent staging
gets FEDERATION_ENABLED=true; PR previews keep the flag empty so
preview journals never emit federation traffic.

- docker-compose.staging.yml: journal accepts FEDERATION_ENABLED +
  FEDERATION_KEY_ENCRYPTION_KEY (both default empty).
- cd-staging.yml: persistent staging env sets FEDERATION_ENABLED=true;
  the encryption key arrives via the existing SOPS decryption.
- secrets.app.env: new FEDERATION_KEY_ENCRYPTION_KEY (SOPS-encrypted,
  generated with openssl rand -hex 32).

Production is unaffected: the flagship compose doesn't pass these vars
and the flag defaults off in code.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/cd-staging.yml

@@ -127,6 +127,10 @@ jobs:
             echo "SENTRY_RELEASE=${{ github.sha }}"
             echo "SENTRY_DSN_JOURNAL=$SENTRY_DSN_JOURNAL"
             echo "SENTRY_DSN_PLANNER=$SENTRY_DSN_PLANNER"
+            # Federation soak on persistent staging only (social-federation
+            # rollout 12.2). FEDERATION_KEY_ENCRYPTION_KEY comes from the
+            # SOPS env decrypted above; previews never set this flag.
+            echo "FEDERATION_ENABLED=true"
           } >> infrastructure/staging.env
 
       - name: Copy compose file + env to server