Ask for missing credentials and create the project's own .env

.env becomes optional. A credential it does not provide (an absent file, an
absent or empty key) is asked, without echo: GITEA_TOKEN at the start,
GITHUB_PAT and GITHUB_USER once GitHub is chosen. An invalid value is asked
again and never shown; when input ends the run stops before any request.
Asked tokens are registered for redaction at once.

After the local project exists the script asks (default no) whether to
create a .env in it. On a yes it holds only the needed keys, is created
private (mode 600) from the start, is excluded from git through
.git/info/exclude (no tracked file changes), is never replaced without a
second yes and is never written when git tracks it. The summary names the
keys, never the values.

New library files credentials.sh and envfile.sh; README, .env.example and
the security decisions updated; tests cover every case.

Task: MIL-005#1
Task: MIL-005#2
Task: MIL-005#3
Task: MIL-005#4
Task: MIL-005#5
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/test-security.sh

@@ -47,12 +47,12 @@ test_full_run_without_github() {
   assert_contains "plan says GitHub is not used" "$OUT" "GitHub repository : not used"
 }
 
-test_github_chosen_without_credentials_fails() {
+test_github_chosen_without_credentials_stops_when_input_ends() {
   write_fixtures
   printf 'GITEA_TOKEN=%s\n' "$FAKE_GITEA_TOKEN" >"$WORK/.env"
   run_cli "$ANSWERS_GITHUB" --config "$WORK/config.env" --env "$WORK/.env"
-  assert_status "missing GitHub credentials" 1 "$STATUS"
-  assert_contains "names the key" "$ERR" "GITHUB_PAT is missing"
+  assert_status "missing GitHub credentials, no answer" 1 "$STATUS"
+  assert_contains "names the credential" "$ERR" "no input available for 'GitHub personal access token'"
   assert_not_contains "no token in the error" "$OUT$ERR" "$FAKE_GITEA_TOKEN"
   assert_eq "temporary files removed" "" "$(find "$WORK/tmp" -mindepth 1)"
 }