Add operator token runbook (two-token split, configure/env gotcha)

infrastructure.md

@@ -136,3 +136,9 @@ architecturally private versus what's a policy commitment — is in the
   plaintext in the portal database (functionally necessary), and the gateway
   must stay publicly reachable for API access (its admin UI and docs are
   disabled; only the `/v1/*` API is exposed).
+
+## For operators
+
+Maintaining the co-op's infrastructure — rotating Cloudron tokens, editing the
+portal's environment, and troubleshooting the provisioning pipeline — is
+documented in the [operator runbook](operator-token-runbook.md).