feat(P01): SLICE-05 operator bootstrap CLI + secrets scope

- TASK-05-01 scripts/create-operator.py: CLI that reads
  PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS + PRAXIS_PG_DSN from env, creates
  the pool, applies migrations, hashes the password with argon2id, and
  INSERTs with ON CONFLICT DO NOTHING (idempotent — D-052). --update
  flag forces rehash + ON CONFLICT DO UPDATE. Missing env → exit 1
  (R-BOOT-02). Connection failure → 3x retry with 5s backoff (R-BOOT-01).
- TASK-05-02 .ciagent/config.json: added "operator" secrets scope
  (PRAXIS_PG_PASSWORD, PRAXIS_COOKIE_SECRET,
  PRAXIS_BOOTSTRAP_OPERATOR_USER/PASS, PRAXIS_VC_ISSUER_KEY).
  .ciagent/.env.secrets.example: template (committed, no real secrets).
  .gitignore: added negations so .env.secrets.example is tracked while
  .env.secrets stays ignored.
- TASK-05-03 tests/test_create_operator.py: 7 tests (mocked PgStore) —
  create, already-exists (no update), --update rehashes, missing env →
  exit 1, password is argon2id (not plaintext).

---ci---
project: praxis
phase: 1
milestone: v0.4
status: execute
persona: devops-engineer
task: 05-01,05-02,05-03
requirements:
  covered: [REQ-AUTH-01]
---/ci---

.ciagent/config.json

@@ -99,6 +99,10 @@
       {
         "name": "voice",
         "env_vars": ["DEEPGRAM_API_KEY", "CARTESIA_API_KEY", "OLLAMA_API_KEY"]
+      },
+      {
+        "name": "operator",
+        "env_vars": ["PRAXIS_PG_PASSWORD", "PRAXIS_COOKIE_SECRET", "PRAXIS_BOOTSTRAP_OPERATOR_USER", "PRAXIS_BOOTSTRAP_OPERATOR_PASS", "PRAXIS_VC_ISSUER_KEY"]
       }
     ]
   },