Store password/token hashes in .env by default too

triggershell users add/add-token now generate a TRIGGERSHELL_USER_<name>_
PASSWORD_HASH / TRIGGERSHELL_TOKEN_<name>_HASH variable in .env (creating
or updating it idempotently) and print a ${VAR} snippet to paste into
auth.users/auth.tokens, instead of printing the raw hash. Pass --inline to
get the old behavior, since a hash - unlike sessionSecret - is safe to
store directly in the config (same trust model as /etc/shadow); this just
gives people who don't want it there at all an easy option.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

examples/triggershell.yml

@@ -13,12 +13,14 @@ auth:
   sessionSecret: "${TRIGGERSHELL_SESSION_SECRET:-dev-only-insecure-session-secret-change-me-before-deploying}"
   sessionTtlHours: 12
   users:
-    # Generate with `triggershell users add`. This demo hash is for the password "admin" -
-    # change it before using this example anywhere but your own machine.
+    # Generate with `triggershell users add` (add --inline for this raw-hash-in-config style;
+    # the default instead stores the hash in .env and gives you a ${VAR} reference). This demo
+    # hash is for the password "admin" - change it before using this example anywhere else.
     - username: admin
       passwordHash: "$argon2id$v=19$m=65536,t=3,p=4$zQavMjKmTLUlSSy8e7doRQ$s6uQeh9rc4Jl+l0GHepH4S8zhcqGfIAbvrxk9F3rT4U"
   tokens:
-    # Generate with `triggershell users add-token`. This demo token is "ci-bot-demo-token".
+    # Generate with `triggershell users add-token` (see the --inline note above). This demo
+    # token is "ci-bot-demo-token".
     - name: ci-bot
       tokenHash: "sha256:131709125e3c04e7c1dd59bc840a997a772ba54ff7448184c558ebc550d9d245"