.env file literacy

Learn load order, .env.example vs .env, and why secrets stay out of Git — resolve vars the way toolchains do.