fix(setup): seed .env template into ~/.secrets/aipass/ on bootstrap (#29)

setup.sh now copies .env.example to ~/.secrets/aipass/.env so new users
get the key template in the right place automatically. Updated .env.example
header to point to the secrets location.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -1,6 +1,6 @@
 # AIPass API Keys
-# Copy this file to .env and fill in your keys:
-#   cp .env.example .env
+# Location: ~/.secrets/aipass/.env (setup.sh copies this automatically)
+# Do NOT put real keys in the repo — this is just a template.
 
 # OpenAI
 OPENAI_API_KEY=

setup.sh

@@ -79,6 +79,12 @@ else
     echo "Secrets directory already exists — skipping"
 fi
 
+# --- Seed .env template into secrets ---
+if [ ! -f "$SECRETS_DIR/.env" ] && [ -f ".env.example" ]; then
+    cp .env.example "$SECRETS_DIR/.env"
+    echo "  Copied .env.example → ~/.secrets/aipass/.env (add your API keys there)"
+fi
+
 # --- Generate branch registry ---
 if [ ! -f "AIPASS_REGISTRY.json" ]; then
     echo "Generating AIPASS_REGISTRY.json ..."