Credential env-var audit + 12-factor inventory

[jrosskopf]

Follow-up from epic #40 / PR #57. A full credential env-var audit was
explicitly deferred when the narrow 12-factor scope landed.

Scope

Audit every place flapi reads a credential from the environment, plus
every `{{env.VAR}}` substitution path through YAML, and produce one
canonical inventory.

Specifically:

1. Read every credential code path:
   • AWS: `credential_manager.cpp` (`AWS_ACCESS_KEY_ID`,
     `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, `AWS_SESSION_TOKEN`,
     `AWS_PROFILE`, ...)
   • GCS: `GOOGLE_APPLICATION_CREDENTIALS`,
     `GOOGLE_CLOUD_PROJECT`
   • Azure: `AZURE_STORAGE_CONNECTION_STRING`,
     `AZURE_STORAGE_ACCOUNT`, `AZURE_STORAGE_KEY`
   • flapi-specific: `FLAPI_CONFIG_SERVICE_TOKEN`,
     `FLAPI_NO_TELEMETRY`, `FLAPI_CONFIG`, `FLAPI_LOG_LEVEL`
   • YAML interpolation: `{{env.VAR}}` against
     `environment-whitelist`
2. Cross-reference against the AWS / GCP / Azure SDK docs to find
   credentials we don't read but ought to (e.g. `AWS_ROLE_ARN` for
   IRSA, `GCE_METADATA_HOST` for VMs).
3. Document the inventory in
   `docs/CONFIG_REFERENCE.md` § "12-factor checklist" + the
   landing-page `docs/tools/server-cli.md` env-vars table.
4. Decide whether to read any additional env vars (or surface
   warnings when a likely-mistyped variant is set — e.g.
   `AWS_ACCESS_KEY` without the `_ID` suffix).

Why

The "secrets stay out of the bundle" invariant from self-packaging
relies on env-var credential delivery. Today the surface is partly
implicit (DuckDB extensions read their own env vars; flapi doesn't
gatekeep). A single authoritative inventory makes the contract
auditable for security review.

Acceptance

• Inventory table in `docs/CONFIG_REFERENCE.md`.
• Mirror in `flapi-landingpage` server-cli + deployment env-vars
  tables.
• Optional: warnings for common typos at startup.

References

• PR feat(self-packaging #47): 12-factor env vars FLAPI_CONFIG + FLAPI_LOG_LEVEL #57 "Out of scope (deferred)" section
• v26.05.23 release notes "Out of scope" section
• `docs/spec/components/security.md` § "Secrets and the bundle"

[jrosskopf]

Closing — the in-repo deliverable is already done.

docs/CONFIG_REFERENCE.md:145-166 contains the "12-factor checklist (environment variables)" table covering:

• AWS: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_DEFAULT_REGION, AWS_SESSION_TOKEN, AWS_ENDPOINT_URL
• Google: GOOGLE_APPLICATION_CREDENTIALS, GOOGLE_CLOUD_PROJECT, GCLOUD_PROJECT, GCP_PROJECT
• Azure: AZURE_STORAGE_CONNECTION_STRING, AZURE_STORAGE_ACCOUNT, AZURE_STORAGE_KEY, AZURE_TENANT_ID, AZURE_CLIENT_ID
• flapi: FLAPI_CONFIG, FLAPI_LOG_LEVEL, FLAPI_CONFIG_SERVICE_TOKEN, FLAPI_NO_TELEMETRY
• The {{env.VAR}} interpolation contract and environment-whitelist enforcement requirement

The list cross-references the actual code paths in src/credential_manager.cpp:10-31, 64-131 and the whitelist enforcement in src/config_manager.cpp:155-156.

The landing-page mirror (server-cli + deployment env-vars tables) lives in the separate flapi-landingpage repo and should be tracked there, not here. The optional startup-warning-for-typo'd env vars (item 4 in the original scope) is not required by anything we ship today; if we want it, a fresh issue scoped just to that is the right shape.