feat: Secure file deletion for .env wipe

Summary

Implement secure deletion for .env files to prevent recovery of sensitive data.

Context

File: internal/envfile/envfile.go:134

// Future: consider secure deletion (overwrite before delete)

Problem

Current Wipe() just calls os.Remove(). On many filesystems, deleted files can be recovered until overwritten.

Security consideration

.env files contain secrets. When wiped (TTL expired or manual cleanup), the data should be unrecoverable.

Implementation

Secure wipe pattern

func Wipe(path string) error {
    info, err := os.Stat(path)
    if err != nil {
        if os.IsNotExist(err) {
            return nil
        }
        return err
    }
    
    // Overwrite with random data
    f, err := os.OpenFile(path, os.O_WRONLY, 0)
    if err != nil {
        return err
    }
    
    size := info.Size()
    random := make([]byte, size)
    rand.Read(random)
    f.Write(random)
    f.Sync()
    f.Close()
    
    // Then delete
    return os.Remove(path)
}

Considerations

• SSD wear leveling may still leave copies
• This is defense in depth, not perfect security
• Could add --secure flag to make it optional (faster default)

Acceptance

• Wipe() overwrites file contents before deletion
• Works on files of any size
• Falls back gracefully if overwrite fails
• Optional: benchmark impact

Start in internal/envfile/envfile.go at Wipe(), especially line 134, and inspect how TTL expiry and manual cleanup call it. Verify behavior for missing, empty, and larger files, including error handling during overwrite. Done means contents are overwritten before deletion, failures are handled gracefully, and the existing cleanup paths still work.