Add entrypoint.sh for key provisioning from env vars or auto-gen

[rubenhensen]

Closes #59

Summary

• Adds entrypoint.sh that runs before the PKG server to provision keys either from environment variables (Scaleway Secrets Manager → Kubernetes secrets) or by auto-generating them if no env vars are set.
• Updates Dockerfile to copy and wire up the entrypoint, create a /keys directory owned by nonroot, and replace the old CMD with ENTRYPOINT.

Key loading behaviour

Env vars set?	Behaviour
Yes (PKG_IBE_SECRET, PKG_IBE_PUBLIC, PKG_IBS_SECRET, PKG_IBS_PUBLIC)	Decode from base64 → write to /keys/
No	Run pg-pkg gen → generate fresh keys into /keys/

The server always starts with explicit --ibe-secret-path /keys/pkg_ibe.sec --ibe-public-path /keys/pkg_ibe.pub --ibs-secret-path /keys/pkg_ibs.sec --ibs-public-path /keys/pkg_ibs.pub.

Test plan

• Build image and start without env vars — verify keys are generated and server starts
• Build image and start with all four env vars set to base64-encoded key files — verify keys are written and server starts with the correct keys
• Verify pod restart with the same env vars serves the same public key