apiops init: generate a Copilot prompt file to audit artifacts against APIM best practices

## Problem or use case

After `apiops extract`, users have no guided way to check their extracted APIM artifacts against APIM best practices. The audit should look for anti-patterns (e.g. named values holding secrets that aren''t marked secret) that otherwise go unnoticed. We want a low-friction, Copilot-assisted audit that also offers to **fix** the issues it finds.

## Proposed solution

Have `apiops init` generate an additional Copilot prompt file — e.g. `.github/prompts/apiops-check-best-practices.prompt.md` — following the same generation pattern as the existing identity-setup prompt (`src/templates/copilot/identity-setup-prompt.ts`, written in `src/services/init-service.ts`). When opened with GitHub Copilot, the prompt guides the user through auditing the artifacts in the repo against a **focused** set of APIM best practices.

### Scope — only things apiops-cli tracks

Keep the checks centered on apiops-managed artifacts (policies, named values, backends, diagnostics/loggers, subscriptions, products). Explicitly **out of scope**: infra/SKU/networking/scale guidance from the WAF doc that doesn''t map to apiops artifacts.

### Checks (initial set)

1. **Hardcoded secrets in `policy.xml`** (headline check) — detect literal secrets in policy XML (`set-header` auth/keys, `set-query-parameter` `code`/`sig`, `authentication-basic` password, `validate-jwt` keys, connection-string fragments).
- **Offer to fix:** create a (secret) **named value** for the secret and rewrite the policy to reference it via `{{named-value}}`, per https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties
2. **Named values holding secrets** that aren''t marked `secret: true` or aren''t Key Vault–backed → flag and offer to mark/migrate.
3. **Backend URLs / keys inlined in policies** instead of using named values/backends → suggest parameterizing.

(Start with check #1; #2–#3 can follow.)

### Reference

APIM best-practice guidance: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-api-management — used as a source, but the prompt should distill only the artifact-level items above rather than the full large-deployment guidance.

## Affected command

`apiops init` (generates the prompt file); the prompt itself assists with `apiops extract` output.

## Implementation notes

- New template under `src/templates/copilot/` (e.g. `best-practices-prompt.ts`) + embedded markdown, mirroring `identity-setup-prompt.ts`.
- Write the file in `init-service.ts` alongside the identity prompt (conflict-check + add to `generatedFiles.configs`), and mention it in the `init-command.ts` next-steps output.
- Relates to #198 (the CLI-side redact-and-warn for the same class of issue; this prompt is the interactive remediation counterpart).

Start with src/templates/copilot/identity-setup-prompt.ts and src/services/init-service.ts to follow the existing prompt-generation pattern. Then inspect src/commands/init-command.ts for the next-steps output and generatedFiles.configs handling. Done means apiops init generates the new prompt alongside the identity prompt, with the focused artifact audit starting with hardcoded secrets in policy.xml and offering remediation.

Written by the indexing model from the issue text.