feat(secrets): GUI-managed .env secrets store — keys are config, but gitignored (#47)

API keys/secrets now live in /data/secrets/.env (gitignored, never in config
YAML), while remaining fully editable from the dashboard. Config YAML holds
only ${VAR} references.

Backend:
- meshai/secrets_store.py: get_status (SET/NOT-SET, never values), set_secret,
  delete_secret over /data/secrets/.env (resolved like load_config); authoritative
  SECRET_FIELD_TO_ENV map (traffic→TOMTOM_API_KEY, firms→FIRMS_MAP_KEY,
  roads511→ROADS511_API_KEY, wzdx→WZDX_API_KEY, smtp→SMTP_PASSWORD,
  mesh_sources→MESHMONITOR_API_TOKEN) + backend-dependent llm_env_var
- dashboard/api/secrets_routes.py: GET /api/secrets (status only), PUT/DELETE
  /api/secrets/{env_var} (validated, restart_required); registered in server.py
- config_loader: save_section preserves ${VAR} secret refs on section save
  (never rejects them); EXPECTED_SECRETS += ROADS511_API_KEY, WZDX_API_KEY
- config.example.yaml + docker-entrypoint default config use ${VAR} refs;
  first-run bootstraps /data/secrets/.env; .gitignore covers it

Frontend:
- components/ManagedSecret.tsx: masked, Set/Not-set badge, reveal, Save->PUT,
  "restart required"; carries no config value so secrets never enter a section
  save payload
- wired into Environment (tomtom/roads511/wzdx/firms), Config LLM tab
  (env var by backend), Notifications (smtp)

Restart required after a secret change (env read at config-load). 11 store
tests; suite at 10-failure baseline (1714 passed).

Co-authored-by: Matt Johnson <mj@k7zvx.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

work/config.example.yaml

@@ -48,7 +48,7 @@ context:
 # === LLM BACKEND ===
 llm:
   backend: openai                # openai | anthropic | google
-  api_key: ""                    # API key (or use LLM_API_KEY env var)
+  api_key: ${GOOGLE_API_KEY}      # Secret: set via dashboard or /data/secrets/.env (var depends on backend: GOOGLE_API_KEY/OPENAI_API_KEY/ANTHROPIC_API_KEY)
   base_url: https://api.openai.com/v1  # API base URL
   model: gpt-4o-mini             # Model name
   timeout: 30                    # Request timeout (seconds)
@@ -184,7 +184,7 @@ environmental:
   traffic:
     enabled: false
     tick_seconds: 300
-    api_key: ""         # Get key at developer.tomtom.com
+    api_key: ${TOMTOM_API_KEY}   # Secret: set via dashboard or /data/secrets/.env (get key at developer.tomtom.com)
     corridors: []
     # Example corridors:
     # - name: "I-84 Twin Falls"
@@ -195,7 +195,7 @@ environmental:
   roads511:
     enabled: false
     tick_seconds: 300
-    api_key: ""
+    api_key: ${ROADS511_API_KEY}   # Secret: set via dashboard or /data/secrets/.env (leave var empty if 511 needs no key)
     base_url: ""        # e.g. "https://511.idaho.gov/api/v2"
     endpoints: ["/get/event"]
     bbox: []            # [west, south, east, north]
@@ -206,7 +206,7 @@ environmental:
   firms:
     enabled: false
     tick_seconds: 1800  # 30 min default
-    map_key: ""         # Required - NASA FIRMS MAP_KEY
+    map_key: ${FIRMS_MAP_KEY}    # Secret: set via dashboard or /data/secrets/.env (NASA FIRMS MAP_KEY)
     source: "VIIRS_SNPP_NRT"  # VIIRS_SNPP_NRT, VIIRS_NOAA20_NRT, MODIS_NRT
     bbox: []            # [west, south, east, north] - Required
     day_range: 1        # 1-10 days of data