feat: add env-backed config and dotenv support

[ahstn]

What

• add dotenv-backed startup loading for existing POSTGRES_* CLI env vars
• add quoted exact-value YAML placeholders like "{env:MY_VAR}" for config-file secrets and other scalar fields
• switch runtime Postgres connections to PgConnectOptions so passwords with URL-reserved characters connect correctly
• document the secure credential flow in the README, record it in PROGRESS.md, and ignore .env files by default

How

• add dotenvy and a pre-clap startup helper that:
  • detects postgreat config -c/--config ... before argument parsing
  • loads .env next to the config file first when present
  • falls back to .env in the current working directory or its parents
  • preserves real environment variables over both dotenv sources
• replace direct serde_yaml -> DbConfig parsing with a raw-config layer that resolves env placeholders and returns explicit errors for missing or invalid env values
• keep the YAML shape stable and limit interpolation to exact quoted scalars rather than embedded strings
• move runtime connection construction onto sqlx::postgres::PgConnectOptions and update the live test support helpers the same way
• add regression coverage for dotenv loading before clap validation, YAML env resolution and precedence, and reserved-character passwords in the live analyze harness

Testing

• cargo fmt --all
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test
• cargo test --test it_analyze -- --ignored --test-threads=1