feat(config): read Bridge password from PM_CLI_BRIDGE_PASSWORD env var

[kochj23]

Summary

Headless servers running pm-cli in automated pipelines often have no desktop
session and therefore no D-Bus secret service, so GetPassword() fails with
org.freedesktop.secrets was not provided by any .service files. This wires an
environment-variable fallback into GetPassword() in internal/config/config.go.

GetPassword() now consults PM_CLI_BRIDGE_PASSWORD before the system
keyring:

• Takes precedence over the keyring, and is only consulted when set and
  non-empty, so interactive users see no change.
• Requires no configured email on the env-var path, since the variable carries
  the credential directly.
• An empty value falls through to the existing keyring path.

README gains a "Headless / automated environments" section documenting the
variable.

Tests

Added internal/config/password_env_test.go covering all seven categories:

• Security – secret env var name never leaks into error text; documented
  constant is guarded against drift.
• Performance – env-var path performs no keyring round-trip (1000 reads).
• Retry – repeated reads are idempotent and stable.
• Unit – env var returned directly; works without email; empty value falls
  back.
• Integration – env var takes precedence over the configured keyring key.
• Functional – full set → unset transition behavior.
• Frame – N/A (plain string, no framing/serialization); explicit skip
  placeholder retained.

go build ./... && go vet ./... && go test ./... all green.

Closes #8

🤖 Generated with Claude Code

[bscott]

Reviewed and verified locally against master: gofmt -l, go vet ./..., and go test ./... all clean. (CI didn't run here because fork PRs need maintainer approval for workflows.)

The change itself is right: env var takes precedence, only when non-empty, and the `c.Bridge.Email == """ check is correctly bypassed since the variable carries the credential itself. README guidance to source it from a secrets manager is a good call.

Merging. One note for future PRs: the test file's "seven review categories" scaffolding adds some noise — TestGetPasswordFrameNA is a t.Skip placeholder and `TestGetPasswordEnvNoKeyringCost" is a 1000-iteration loop that doesn't assert a timing bound. The substantive tests around precedence and empty-value fallback are the valuable ones. Not blocking.

Closes #8.