Remove Matrix credentials from global memory — load at call time

Fix #605: Remove MATRIX_HOMESERVER, MATRIX_ACCESS_TOKEN, MATRIX_ROOM_ID from module-level globals.
Credentials are now read at call time in send_alert() via _read_env_value() to minimize
credential lifetime in process memory.

Fix #606: Update deploy.sh to use Infisical creds CLI instead of .secrets file.
Fetches NET_ALERTER_PASSWORD from matrix folder in Infisical vault, then generates
access token at deploy time.

All 16 net_alerter tests pass when run individually or in groups.

net_alerter/deploy.sh

@@ -9,21 +9,28 @@ REMOTE_DIR="/opt/net_alerter"
 SCRIPT="$(dirname "$0")/net_alerter.py"
 
 # Matrix access token for net-alerter service account
-# Get fresh token if not passed — credentials stored in secrets file
-SECRETS_FILE="$(dirname "$0")/.secrets"
+# Get fresh token from Infisical or accept as argument
 if [[ -n "${1:-}" ]]; then
   TOKEN="$1"
-elif [[ -f "$SECRETS_FILE" ]]; then
-  # shellcheck source=/dev/null
-  source "$SECRETS_FILE"
-  echo "[*] Fetching Matrix access token for net-alerter..."
+else
+  echo "[*] Fetching Matrix credentials from Infisical..."
+  CREDS="${HOME}/.local/bin/creds"
+  if ! command -v "$CREDS" &>/dev/null; then
+    echo "[error] creds CLI not found at $CREDS — install Infisical client first"
+    exit 1
+  fi
+
+  MATRIX_PASS=$("$CREDS" get NET_ALERTER_PASSWORD matrix)
+  if [[ -z "$MATRIX_PASS" ]]; then
+    echo "[error] Could not fetch NET_ALERTER_PASSWORD from Infisical (matrix folder)"
+    exit 1
+  fi
+
+  echo "[*] Generating Matrix access token for net-alerter..."
   TOKEN=$(curl -s -X POST https://m.example.org/_matrix/client/v3/login \
     -H "Content-Type: application/json" \
-    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${NET_ALERTER_MATRIX_PASS}\"}" \
+    -d "{\"type\":\"m.login.password\",\"identifier\":{\"type\":\"m.id.user\",\"user\":\"net-alerter\"},\"password\":\"${MATRIX_PASS}\"}" \
     | python3 -c "import sys,json; print(json.load(sys.stdin)['access_token'])")
-else
-  echo "[error] Pass a token as \$1 or create $(dirname "$0")/.secrets with NET_ALERTER_MATRIX_PASS=..."
-  exit 1
 fi
 
 echo "[*] Deploying to $SSH_ALIAS..."