Move secrets and URLs out of source into .env

Adds a stdlib-only loader (src/lib/env.py) that walks up to find the
nearest .env. display.py and notebooks/_helpers.py now `require()` the
config values; wifi-check.sh sources .env to derive its probe host. The
.env file is gitignored; .env.example documents the required keys. The
existing tokens are still present in git history and will be scrubbed
in the next commit; rotate them after the rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sync.sh

@@ -1,2 +1,2 @@
 #!/bin/bash
-rsync -avz --progress src/ andras@192.168.0.81:~/frame/
+rsync -avz --progress --exclude=.env src/ andras@192.168.0.81:~/frame/