feat(config): read Bridge password from PM_CLI_BRIDGE_PASSWORD env var

[kochj23]

Summary

Headless servers running pm-cli in automated pipelines often have no desktop
session and therefore no D-Bus secret service, so GetPassword() fails with
org.freedesktop.secrets was not provided by any .service files. This wires an
environment-variable fallback into GetPassword() in internal/config/config.go.

GetPassword() now consults PM_CLI_BRIDGE_PASSWORD before the system
keyring:

• Takes precedence over the keyring, and is only consulted when set and
  non-empty, so interactive users see no change.
• Requires no configured email on the env-var path, since the variable carries
  the credential directly.
• An empty value falls through to the existing keyring path.

README gains a "Headless / automated environments" section documenting the
variable.

Tests

Added internal/config/password_env_test.go covering all seven categories:

• Security – secret env var name never leaks into error text; documented
  constant is guarded against drift.
• Performance – env-var path performs no keyring round-trip (1000 reads).
• Retry – repeated reads are idempotent and stable.
• Unit – env var returned directly; works without email; empty value falls
  back.
• Integration – env var takes precedence over the configured keyring key.
• Functional – full set → unset transition behavior.
• Frame – N/A (plain string, no framing/serialization); explicit skip
  placeholder retained.

go build ./... && go vet ./... && go test ./... all green.

Closes #8

🤖 Generated with Claude Code