docs: wire INFRA_DEPLOY_KEY — CI now auto-deploys (#2)

Deploy job's INFRA_DEPLOY_KEY (write deploy-key cad-atlas-ci on infra) is set;
future main pushes auto-bump the infra image tag → Flux rolls. Also records the
live Authentik-gated endpoint. This commit is itself the first auto-deploy test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/INCEPTION-OATH.md

@@ -28,9 +28,10 @@ Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath
 
 ## Deployment
 
-Live on koala k3s: namespace `cad-atlas`, 1 replica, served via ClusterIP `cad-atlas:80 → :8080`
-(manifests in `mathias/infra` `k3s/apps/cad-atlas/`, reconciled by Flux). First deploy was
-GitOps-direct; the CI `deploy` job auto-deploys future pushes once `INFRA_DEPLOY_KEY` is set (#2).
+Live at **https://atlas.d-ma.be** (Authentik forward-auth — authed users only) on koala k3s:
+namespace `cad-atlas`, 1 replica, `cad-atlas:80 → :8080` (manifests in `mathias/infra`
+`k3s/apps/cad-atlas/`, reconciled by Flux). CI `deploy` job **auto-deploys** on every main push —
+`INFRA_DEPLOY_KEY` (write deploy-key `cad-atlas-ci` on infra) is wired (#2 done).
 
 ## The honesty rule