docs(designs): add secrets and pki design

[jmgilman]

Summary

• add a Secrets and PKI design covering AWS-authoritative SOPS bootstrap, GitHub App repo access, scoped KMS decryption, and per-cluster Vault
• document public HTTP TLS through Let's Encrypt/Route 53 DNS-01 and internal PKI through KMS-rooted per-cluster Vault CAs
• call out step-ca retirement, root CA rebootstrap into the current lab AWS account, and implementation slices

Validation

• moon run docs:check
• npm run typecheck
• npm run build