Document/enforce best-practices for config secrets as environment vars via `.env`

[cacama-valvata]

disallow the user to put creds into bcds.yaml, forcing env vars. if they want to put it into a file, it must be .env.

i think having init cmd adding a .gitignore that lists .env is not a bad idea also