Docs: env var redaction section uses setting keys that do not exist

### What happened?

The "Environment variable redaction" section of `docs/reference/configuration.md` tells you to configure redaction with these keys:

```json
{
"security": {
"allowedEnvironmentVariables": ["MY_PUBLIC_KEY", "NOT_A_SECRET_TOKEN"],
"blockedEnvironmentVariables": ["INTERNAL_IP_ADDRESS"]
}
}
```

Neither key exists. `schemas/settings.schema.json` contains no `allowedEnvironmentVariables` or `blockedEnvironmentVariables` anywhere, and `security` is declared `"additionalProperties": false`, so that example is actually schema-invalid — an editor using the published schema flags it.

The real settings are nested one level deeper, under `security.environmentVariableRedaction`:

- `security.environmentVariableRedaction.allowed`
- `security.environmentVariableRedaction.blocked`
- `security.environmentVariableRedaction.enabled`

That's what `packages/cli/src/config/config.ts` actually reads:

```ts
blockedEnvironmentVariables:
settings.security?.environmentVariableRedaction?.blocked,
allowedEnvironmentVariables:
settings.security?.environmentVariableRedaction?.allowed,
enableEnvironmentVariableRedaction:
settings.security?.environmentVariableRedaction?.enabled,
```

The same document already documents the correct keys at the settings list further up (the `security.environmentVariableRedaction.*` entries), so the page contradicts itself.

There's a second problem in the same section: it never mentions `enabled`, which defaults to `false` (`packages/core/src/config/config.ts`: `params.enableEnvironmentVariableRedaction ?? false`). The section describes redaction behavior in detail as though it's active, but redaction is off unless you explicitly turn it on.

This matters more than a typical docs typo because it's a security feature. Someone follows the docs, adds the documented keys, and reasonably believes secrets are being redacted — when nothing reads those keys and the feature is off by default.

### What did you expect to happen?

The configuration section should use the key names the CLI actually reads (`security.environmentVariableRedaction.allowed` / `.blocked`), and should say that `enabled` defaults to `false` so readers know the described behavior requires opting in.

### Client information

Found by reading the source rather than at runtime, so this isn't version-specific behavior — it's a mismatch between `docs/reference/configuration.md`, `schemas/settings.schema.json`, and `packages/cli/src/config/config.ts` on current `main` (package version `0.56.0-nightly.20260806.g761f604c1`).

Reproducible without running the CLI: search the schema for `allowedEnvironmentVariables` (0 hits), then compare with the `security.environmentVariableRedaction` block.

Update the environment variable redaction section in docs/reference/configuration.md, using the security.environmentVariableRedaction entries already listed above. Compare the example with schemas/settings.schema.json and the reads in packages/cli/src/config/config.ts; document allowed, blocked, and enabled, including that enabled defaults to false. Done when the example is schema-valid and no longer contradicts the source or settings list.

Written by the indexing model from the issue text.