Ask for missing credentials and create the project's own .env

.env becomes optional. A credential it does not provide (an absent file, an
absent or empty key) is asked, without echo: GITEA_TOKEN at the start,
GITHUB_PAT and GITHUB_USER once GitHub is chosen. An invalid value is asked
again and never shown; when input ends the run stops before any request.
Asked tokens are registered for redaction at once.

After the local project exists the script asks (default no) whether to
create a .env in it. On a yes it holds only the needed keys, is created
private (mode 600) from the start, is excluded from git through
.git/info/exclude (no tracked file changes), is never replaced without a
second yes and is never written when git tracks it. The summary names the
keys, never the values.

New library files credentials.sh and envfile.sh; README, .env.example and
the security decisions updated; tests cover every case.

Task: MIL-005#1
Task: MIL-005#2
Task: MIL-005#3
Task: MIL-005#4
Task: MIL-005#5
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/lib/config.sh

@@ -4,7 +4,7 @@
 #
 # Part of create-project.sh: sourced by it, never run on its own.
 #
-# Provides: unquote_value, parse_env_file, parse_env_entry, validate_config, check_preset, check_preset_choice, validate_project_presets, validate_credentials, require_github_credentials, warn_if_env_unsafe, load_configuration
+# Provides: unquote_value, parse_env_file, parse_env_entry, validate_config, check_preset, check_preset_choice, validate_project_presets, validate_credentials, warn_if_env_unsafe, load_configuration
 
 # unquote_value RAW: strip matching quotes (or a trailing " # comment" on an
 # unquoted value) and return the value in REPLY. Fails on unbalanced quotes.
@@ -144,20 +144,23 @@ validate_project_presets() {
   check_preset_choice ENABLE_PLAN_GATE yes no
 }
 
+# validate_credentials: check the credentials that .env provides. A credential
+# that is not provided is not an error: it is asked later (collect_credentials).
 validate_credentials() {
-  if [[ -z ${CREDENTIALS[GITEA_TOKEN]:-} ]]; then
-    die "GITEA_TOKEN is missing in $ENV_FILE (see .env.example)"
-  fi
   # Register secrets first so that no later message can show them.
-  SECRET_VALUES+=("${CREDENTIALS[GITEA_TOKEN]}")
+  if [[ -n ${CREDENTIALS[GITEA_TOKEN]:-} ]]; then
+    SECRET_VALUES+=("${CREDENTIALS[GITEA_TOKEN]}")
+  fi
   if [[ -n ${CREDENTIALS[GITHUB_PAT]:-} ]]; then
     SECRET_VALUES+=("${CREDENTIALS[GITHUB_PAT]}")
   fi
-  is_valid_token "${CREDENTIALS[GITEA_TOKEN]}" ||
-    die "GITEA_TOKEN in $ENV_FILE is not a valid token (8 to 255 letters, digits or _ . ~ + / = -)"
+  if [[ -n ${CREDENTIALS[GITEA_TOKEN]:-} ]] &&
+    ! is_valid_token "${CREDENTIALS[GITEA_TOKEN]}"; then
+    die "GITEA_TOKEN in $ENV_FILE is not a valid token ($HINT_TOKEN)"
+  fi
   if [[ -n ${CREDENTIALS[GITHUB_PAT]:-} ]] &&
     ! is_valid_token "${CREDENTIALS[GITHUB_PAT]}"; then
-    die "GITHUB_PAT in $ENV_FILE is not a valid token (8 to 255 letters, digits or _ . ~ + / = -)"
+    die "GITHUB_PAT in $ENV_FILE is not a valid token ($HINT_TOKEN)"
   fi
   if [[ -n ${CREDENTIALS[GITHUB_USER]:-} ]] &&
     ! is_valid_github_owner "${CREDENTIALS[GITHUB_USER]}"; then
@@ -165,16 +168,6 @@ validate_credentials() {
   fi
 }
 
-# GitHub credentials are only needed when the Maintainer chose GitHub.
-require_github_credentials() {
-  local key
-  for key in GITHUB_PAT GITHUB_USER; do
-    if [[ -z ${CREDENTIALS[$key]:-} ]]; then
-      die "GitHub was chosen but $key is missing in $ENV_FILE (see .env.example)"
-    fi
-  done
-}
-
 warn_if_env_unsafe() {
   local file="$1" dir mode
   case "$(uname -s 2>/dev/null || true)" in
@@ -200,7 +193,10 @@ warn_if_env_unsafe() {
 load_configuration() {
   parse_env_file "$CONFIG_FILE" CONFIG_KEYS CONFIG
   validate_config
-  parse_env_file "$ENV_FILE" CREDENTIAL_KEYS CREDENTIALS
+  # .env is optional: a credential it does not provide is asked.
+  if [[ -e $ENV_FILE ]]; then
+    parse_env_file "$ENV_FILE" CREDENTIAL_KEYS CREDENTIALS
+    warn_if_env_unsafe "$ENV_FILE"
+  fi
   validate_credentials
-  warn_if_env_unsafe "$ENV_FILE"
 }