Externalize auth secrets to .env and rename default config to triggershell.yml

sessionSecret was previously baked directly into the scaffolded config file;
`triggershell init` now generates a .env with TRIGGERSHELL_SESSION_SECRET
instead and references it via ${VAR} interpolation, keeping the actual
secret out of the (often committed) config file. `triggershell dev/start/
validate` load that .env automatically without overriding real env vars.

Also renames the default config filename from triggershell.config.yaml to
triggershell.yml throughout the CLI, app, docs, and examples.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/test_config.py

@@ -6,7 +6,7 @@ from triggershell.config import ConfigError, preflight_check
 
 
 def write(tmp_path: Path, content: str) -> Path:
-    path = tmp_path / "triggershell.config.yaml"
+    path = tmp_path / "triggershell.yml"
     path.write_text(content)
     return path