feat: migrate secrets to Infisical

docs/architecture.md

@@ -911,12 +911,9 @@ The notification router sends Data Change review items to agents who hold
 delivery for each authorized queue. Submission creates Immediate alerts;
 `oversight_notification_queue` stores consolidated alerts.
 
-Production must run the idempotent dispatcher once per minute from one scheduler
-instance:
-
-```text
-* * * * * cd /path/to/shd.build && npm run notifications:oversight:production
-```
+The production Compose scheduler calls the internal scheduler endpoint once per
+minute. That endpoint runs the idempotent dispatcher in the application process,
+which owns the embedded-database connection. Do not run a second host cron job.
 
 The dispatcher groups due rows by reviewer, queue, cadence, and delivery window.
 Daily rows use the next 10:00 AM wall-clock boundary in `America/New_York`,
@@ -941,12 +938,7 @@ default welcome introduces News, Database, Builds, Guides, Builder, ISAC
 Contributor Mode, and the SHD Discord community.
 
 The registration request delivers Immediate definitions.
-`automated_system_message_deliveries` stores definitions with a delay.
-Production must run the delayed dispatcher once per minute:
-
-```text
-* * * * * cd /path/to/shd.build && npm run notifications:system:production
-```
-
-Only one dispatcher instance should run for the embedded database. Delivered
-rows retain both their delivery timestamp and generated notification ID.
+`automated_system_message_deliveries` stores definitions with a delay. The same
+Compose scheduler tick runs the delayed dispatcher. Only one scheduler instance
+should call the embedded-database application. Delivered rows retain both their
+delivery timestamp and generated notification ID.