Config v2: XDG, permissions check, env/command secret indirection, back-compat

XDG path (~/.config/dbui/config.yml), 0600 warning, ${ENV_VAR} expansion in DSNs, dsn_cmd for secret managers (1Password/pass/security) — no native keyring lib (dsn_cmd covers it and works headless). Validation at load (duplicate aliases, unknown types, empty DSN). Legacy ./dbui.yml, ~/dbui.yml and -dsn/-type/-f keep working with a one-time deprecation notice.

**Acceptance:** existing documented setups work unchanged; secrets never need to live in the file; validation errors are positional.

Start by tracing the current configuration loading and the -dsn, -type, and -f command-line entry points. Compare the existing behavior with the XDG path, legacy paths, environment and dsn_cmd inputs, permission warning, validation, and deprecation requirements; done means documented setups remain compatible and validation errors identify their positions.

Written by the indexing model from the issue text.