DATABASE_URL + APP_SECRET now reference umami-secrets-infisical. Postgres (3b-i) already healthy on the same secret; umami's wait-for-postgres initContainer enforces ordering. Old umami-secrets stays live until 3c. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>