Externalize auth secrets to .env and rename default config to triggershell.yml

sessionSecret was previously baked directly into the scaffolded config file;
`triggershell init` now generates a .env with TRIGGERSHELL_SESSION_SECRET
instead and references it via ${VAR} interpolation, keeping the actual
secret out of the (often committed) config file. `triggershell dev/start/
validate` load that .env automatically without overriding real env vars.

Also renames the default config filename from triggershell.config.yaml to
triggershell.yml throughout the CLI, app, docs, and examples.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/.env.example

@@ -0,0 +1,5 @@
+# Copy this file to `.env` (same directory as triggershell.yml) and set a real value.
+# TriggerShell loads .env automatically from the config file's directory and makes its
+# variables available to ${VAR} interpolation in the config - this is how secrets like
+# sessionSecret should be kept out of the config file (and out of version control).
+TRIGGERSHELL_SESSION_SECRET=dev-only-insecure-session-secret-change-me-before-deploying

examples/triggershell.yml

@@ -8,7 +8,8 @@ server:
 auth:
   # Set to false for trusted/local-only use - no login required.
   enabled: true
-  # Must be >= 32 characters. Generate one with `triggershell init` or `openssl rand -hex 32`.
+  # Must be >= 32 characters. Loaded from .env (see .env.example) - the fallback after `:-` only
+  # exists so this example runs with zero setup; don't rely on it for anything real.
   sessionSecret: "${TRIGGERSHELL_SESSION_SECRET:-dev-only-insecure-session-secret-change-me-before-deploying}"
   sessionTtlHours: 12
   users: