Move secrets and URLs out of source into .env

Adds a stdlib-only loader (src/lib/env.py) that walks up to find the
nearest .env. display.py and notebooks/_helpers.py now `require()` the
config values; wifi-check.sh sources .env to derive its probe host. The
.env file is gitignored; .env.example documents the required keys. The
existing tokens are still present in git history and will be scrubbed
in the next commit; rotate them after the rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/wifi-check.sh

@@ -4,7 +4,13 @@
 # brcmfmac chip on the Pi Zero 2W.
 
 CONNECTION="netplan-wlan0-HiddenPlace"
-PROBE_HOST="homeassistant.example.com"
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck disable=SC1091
+[ -f "$SCRIPT_DIR/.env" ] && set -a && . "$SCRIPT_DIR/.env" && set +a
+PROBE_HOST="${HA_URL#http*://}"
+PROBE_HOST="${PROBE_HOST%%/*}"
+: "${PROBE_HOST:?HA_URL must be set in .env}"
 
 probe() {
     ping -c 1 -W 5 192.168.0.1 >/dev/null 2>&1 \