ci: use sops for deployment variables

[debuggingfuture]

• try to decouple env vars github action secreets
• for those needed in storybook
• streamline source of truth with config.ts vs env.sample

[debuggingfuture]

• clean up existing github actions secrets / workflow