Environment variable names in completion and hover

[gandarfh]

What

The server accepts --db <path> (the app's SQLite database) and enriches completion and hover with the variable names of the active environment. Completion inside {{ now offers block aliases plus env keys (secret ones labeled); hovering a bare {{KEY}} that matches an active-environment variable says so, with a secret note when applicable.

Privacy invariant

The server reads key and is_secret only — never value, secret or not. Values belong to the execution path; this process has no keychain access by design and now provably never selects the value column either.

Implementation

• bin/env_store.ml: lazy read-only caqti connection, one query per request (reads measured in the tens of microseconds; the active environment can change while the server runs, so no caching). Missing --db or a failed read degrades to the previous behavior.
• Analyze.completion_at/hover_at take the env names as input data, keeping the library pure — the IO shell supplies them.

Tests

48 checks. New: completion appends env keys with the secret flag, hover marks a secret env var, and a third integration session spawns the binary with --db pointing at a fixture database created by the test (schema mirroring the app's environments/env_variables), asserting env keys and the secret detail arrive over the protocol.