apiops init: generate a Copilot prompt file to audit artifacts against APIM best practices

## Problem or use case

After `apiops extract`, users have no guided way to check their extracted APIM artifacts against APIM best practices. The audit should look for anti-patterns (e.g. named values holding secrets that aren''t marked secret) that otherwise go unnoticed. We want a low-friction, Copilot-assisted audit that also offers to **fix** the issues it finds.

## Proposed solution

Have `apiops init` generate an additional Copilot prompt file — e.g. `.github/prompts/apiops-check-best-practices.prompt.md` — following the same generation pattern as the existing identity-setup prompt (`src/templates/copilot/identity-setup-prompt.ts`, written in `src/services/init-service.ts`). When opened with GitHub Copilot, the prompt guides the user through auditing the artifacts in the repo against a **focused** set of APIM best practices.

### Scope — only things apiops-cli tracks

Keep the checks centered on apiops-managed artifacts (policies, named values, backends, diagnostics/loggers, subscriptions, products). Explicitly **out of scope**: infra/SKU/networking/scale guidance from the WAF doc that doesn''t map to apiops artifacts.

### Checks (initial set)

1. **Hardcoded secrets in `policy.xml`** (headline check) — detect literal secrets in policy XML (`set-header` auth/keys, `set-query-parameter` `code`/`sig`, `authentication-basic` password, `validate-jwt` keys, connection-string fragments).
- **Offer to fix:** create a (secret) **named value** for the secret and rewrite the policy to reference it via `{{named-value}}`, per https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties
2. **Named values holding secrets** that aren''t marked `secret: true` or aren''t Key Vault–backed → flag and offer to mark/migrate.
3. **Backend URLs / keys inlined in policies** instead of using named values/backends → suggest parameterizing.

(Start with check #1; #2–#3 can follow.)

### Reference

APIM best-practice guidance: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-api-management — used as a source, but the prompt should distill only the artifact-level items above rather than the full large-deployment guidance.

## Affected command

`apiops init` (generates the prompt file); the prompt itself assists with `apiops extract` output.

## Implementation notes

- New template under `src/templates/copilot/` (e.g. `best-practices-prompt.ts`) + embedded markdown, mirroring `identity-setup-prompt.ts`.
- Write the file in `init-service.ts` alongside the identity prompt (conflict-check + add to `generatedFiles.configs`), and mention it in the `init-command.ts` next-steps output.
- Relates to #198 (the CLI-side redact-and-warn for the same class of issue; this prompt is the interactive remediation counterpart).

Bắt đầu với src/templates/copilot/identity-setup-prompt.ts và src/services/init-service.ts để theo dõi mẫu tạo prompt hiện có. Sau đó kiểm tra src/commands/init-command.ts để xem output của các bước tiếp theo và cách xử lý generatedFiles.configs. Công việc được xem là hoàn tất khi apiops init tạo prompt mới cùng với identity prompt, đồng thời focused artifact audit bắt đầu bằng việc tìm các secrets hardcoded trong policy.xml và đưa ra phương án khắc phục.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.