Externalize auth secrets to .env and rename default config to triggershell.yml

sessionSecret was previously baked directly into the scaffolded config file;
`triggershell init` now generates a .env with TRIGGERSHELL_SESSION_SECRET
instead and references it via ${VAR} interpolation, keeping the actual
secret out of the (often committed) config file. `triggershell dev/start/
validate` load that .env automatically without overriding real env vars.

Also renames the default config filename from triggershell.config.yaml to
triggershell.yml throughout the CLI, app, docs, and examples.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/src/lib/config/load.ts

@@ -38,7 +38,7 @@ export function resolveConfigPath(configPathArg?: string): string {
   const candidate =
     configPathArg ??
     process.env.TRIGGERSHELL_CONFIG_PATH ??
-    "triggershell.config.yaml";
+    "triggershell.yml";
   return path.resolve(/*turbopackIgnore: true*/ candidate);
 }