Store password/token hashes in .env by default too

triggershell users add/add-token now generate a TRIGGERSHELL_USER_<name>_
PASSWORD_HASH / TRIGGERSHELL_TOKEN_<name>_HASH variable in .env (creating
or updating it idempotently) and print a ${VAR} snippet to paste into
auth.users/auth.tokens, instead of printing the raw hash. Pass --inline to
get the old behavior, since a hash - unlike sessionSecret - is safe to
store directly in the config (same trust model as /etc/shadow); this just
gives people who don't want it there at all an easy option.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -56,7 +56,7 @@ auth:
   sessionSecret: "${TRIGGERSHELL_SESSION_SECRET}" # >= 32 chars
   users:
     - username: admin
-      passwordHash: "$argon2id$..." # from `triggershell users add`
+      passwordHash: "${TRIGGERSHELL_USER_ADMIN_PASSWORD_HASH}" # from `triggershell users add`
   tokens: []
 
 database:
@@ -104,8 +104,8 @@ the script — always as a discrete argv element or env var, never interpolated
 | `triggershell dev [-c CONFIG] [--port] [--host] [--no-browser]` | Run in development mode (hot reload) |
 | `triggershell start [-c CONFIG] [--port] [--host] [--no-browser] [--skip-build]` | Build (if stale) and run in production mode |
 | `triggershell doctor` | Print environment/config diagnostics |
-| `triggershell users add <username>` | Hash a password and print a config snippet for `auth.users` |
-| `triggershell users add-token <name>` | Generate an API token and print a config snippet for `auth.tokens` |
+| `triggershell users add <username> [-c CONFIG] [--inline]` | Hash a password, store it in `.env`, and print a `${VAR}` snippet for `auth.users` (`--inline` prints the raw hash instead) |
+| `triggershell users add-token <name> [-c CONFIG] [--inline]` | Generate an API token, store its hash in `.env`, and print a `${VAR}` snippet for `auth.tokens` (`--inline` prints the raw hash instead) |
 
 ## Web App Guide
 
@@ -177,8 +177,11 @@ See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) for how the pieces fit togeth
 - Route Handlers check auth themselves (`requireAuth()`); `proxy.ts` is only a fast, optimistic
   redirect layer, not the security boundary.
 - `auth.sessionSecret` should live in `.env`, not the config file — `triggershell init` sets this
-  up for you. Only `passwordHash`/`tokenHash` values (one-way hashes, not the secrets themselves)
-  belong in the config.
+  up for you. `passwordHash`/`tokenHash` are one-way hashes (not the secrets themselves), so
+  storing them directly in the config is reasonably safe — the same trust model as `/etc/shadow`
+  or `.htpasswd` — but `triggershell users add`/`add-token` store them in `.env` via `${VAR}` by
+  default too, for cases where you don't want them readable by anyone with config access at all.
+  Pass `--inline` to get the old behavior of printing the raw hash to paste into the config.
 
 ## License