v0.1.8

Secret-handling hardening release.\n\nHighlights:\n- guided setup now steers secret entry into .env by default\n- docs explicitly keep SHOPIFY_API_KEY, SHOPIFY_API_SECRET, and SHOPIFY_ACCESS_TOKEN in .env only\n- public examples no longer encourage passing secrets as CLI flags\n- setup/doctor output now explains local secret handling more clearly\n