Ask for missing credentials and create the project's own .env

.env becomes optional. A credential it does not provide (an absent file, an
absent or empty key) is asked, without echo: GITEA_TOKEN at the start,
GITHUB_PAT and GITHUB_USER once GitHub is chosen. An invalid value is asked
again and never shown; when input ends the run stops before any request.
Asked tokens are registered for redaction at once.

After the local project exists the script asks (default no) whether to
create a .env in it. On a yes it holds only the needed keys, is created
private (mode 600) from the start, is excluded from git through
.git/info/exclude (no tracked file changes), is never replaced without a
second yes and is never written when git tracks it. The summary names the
keys, never the values.

New library files credentials.sh and envfile.sh; README, .env.example and
the security decisions updated; tests cover every case.

Task: MIL-005#1
Task: MIL-005#2
Task: MIL-005#3
Task: MIL-005#4
Task: MIL-005#5
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/lib/credentials.sh

@@ -0,0 +1,42 @@
+# shellcheck shell=bash
+# shellcheck disable=SC2004,SC2034,SC2154  # shared state and arrays are declared in constants.sh
+# credentials.sh - Asking for a credential that .env does not provide.
+#
+# Part of create-project.sh: sourced by it, never run on its own.
+#
+# Provides: credential_label, collect_credentials
+
+# credential_label KEY: the name of a credential as the Maintainer sees it.
+credential_label() {
+  case "$1" in
+    GITEA_TOKEN) printf 'Gitea access token' ;;
+    GITHUB_PAT) printf 'GitHub personal access token' ;;
+    GITHUB_USER) printf 'GitHub account name (the account the token belongs to)' ;;
+    *) printf '%s' "$1" ;;
+  esac
+}
+
+# collect_credentials KEY...: ask for each credential that is not already
+# provided. A token is read without echo and registered as a secret at once,
+# so no later message can show it; the GitHub account name is not secret and
+# is read like any other answer. An empty value in .env counts as not provided.
+collect_credentials() {
+  local key
+  for key in "$@"; do
+    if [[ -n ${CREDENTIALS[$key]:-} ]]; then
+      continue
+    fi
+    case "$key" in
+      GITHUB_USER)
+        prompt_value "$(credential_label "$key")" "" is_valid_github_owner \
+          "use letters, digits or '-' (at most 39)"
+        ;;
+      *)
+        prompt_secret "$(credential_label "$key")" is_valid_token "$HINT_TOKEN"
+        SECRET_VALUES+=("$REPLY")
+        ;;
+    esac
+    CREDENTIALS[$key]="$REPLY"
+    REPLY=""
+  done
+}