apiops init: generate a Copilot prompt file to audit artifacts against APIM best practices

## Problem or use case

After `apiops extract`, users have no guided way to check their extracted APIM artifacts against APIM best practices. The audit should look for anti-patterns (e.g. named values holding secrets that aren''t marked secret) that otherwise go unnoticed. We want a low-friction, Copilot-assisted audit that also offers to **fix** the issues it finds.

## Proposed solution

Have `apiops init` generate an additional Copilot prompt file — e.g. `.github/prompts/apiops-check-best-practices.prompt.md` — following the same generation pattern as the existing identity-setup prompt (`src/templates/copilot/identity-setup-prompt.ts`, written in `src/services/init-service.ts`). When opened with GitHub Copilot, the prompt guides the user through auditing the artifacts in the repo against a **focused** set of APIM best practices.

### Scope — only things apiops-cli tracks

Keep the checks centered on apiops-managed artifacts (policies, named values, backends, diagnostics/loggers, subscriptions, products). Explicitly **out of scope**: infra/SKU/networking/scale guidance from the WAF doc that doesn''t map to apiops artifacts.

### Checks (initial set)

1. **Hardcoded secrets in `policy.xml`** (headline check) — detect literal secrets in policy XML (`set-header` auth/keys, `set-query-parameter` `code`/`sig`, `authentication-basic` password, `validate-jwt` keys, connection-string fragments).
- **Offer to fix:** create a (secret) **named value** for the secret and rewrite the policy to reference it via `{{named-value}}`, per https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties
2. **Named values holding secrets** that aren''t marked `secret: true` or aren''t Key Vault–backed → flag and offer to mark/migrate.
3. **Backend URLs / keys inlined in policies** instead of using named values/backends → suggest parameterizing.

(Start with check #1; #2–#3 can follow.)

### Reference

APIM best-practice guidance: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-api-management — used as a source, but the prompt should distill only the artifact-level items above rather than the full large-deployment guidance.

## Affected command

`apiops init` (generates the prompt file); the prompt itself assists with `apiops extract` output.

## Implementation notes

- New template under `src/templates/copilot/` (e.g. `best-practices-prompt.ts`) + embedded markdown, mirroring `identity-setup-prompt.ts`.
- Write the file in `init-service.ts` alongside the identity prompt (conflict-check + add to `generatedFiles.configs`), and mention it in the `init-command.ts` next-steps output.
- Relates to #198 (the CLI-side redact-and-warn for the same class of issue; this prompt is the interactive remediation counterpart).

Empieza por src/templates/copilot/identity-setup-prompt.ts y src/services/init-service.ts para seguir el patrón existente de generación de prompts. Después, inspecciona src/commands/init-command.ts para revisar la salida de los siguientes pasos y el manejo de generatedFiles.configs. Se considera terminado cuando apiops init genera el nuevo prompt junto al prompt de identidad, y la auditoría focalizada del artefacto comienza con la búsqueda de secretos codificados directamente en policy.xml y ofrece su corrección.

Escrito por el modelo de indexación a partir del texto del issue.