Add file-backed environment secrets

docs/config.md

@@ -18,7 +18,7 @@ Precedence is:
 
 The implemented configuration overrides are `--units` and `--tz`. Output flags
 control report copies for the current command but do not change configuration
-files. Environment-variable configuration is not implemented.
+files. Environment variables do not override configuration fields.
 
 ## Minimal Config
 
@@ -64,6 +64,18 @@ multiple configured forecast locations.
 The prompt-facing location object also includes `timezone`, derived from the
 effective `weather_api.timezone` after CLI overrides such as `--tz`.
 
+### `secrets`
+
+- `directory`: optional directory of file-backed environment secrets. Default:
+  empty, which disables secret loading.
+
+When configured, each regular file directly under `secrets.directory` is loaded
+after config file parsing and CLI overrides. The file basename must be a valid
+environment variable name matching `[A-Za-z_][A-Za-z0-9_]*`; the file contents
+become the environment variable value and overwrite any existing value. One
+trailing LF or CRLF is stripped. Subdirectories, symlinks, invalid filenames,
+missing directories, and unreadable files fail config loading.
+
 ### `missing_source`
 
 - `default`: missing-source behavior for optional sources. One of `error`, `warn`, or `none`. Default: `warn`.
@@ -115,8 +127,9 @@ snapshot exists and a threshold is crossed.
 
 ## Secrets
 
-Configuration files should not contain secrets. The current Weather API and
-Scriptorium integration settings do not require secret fields.
+Configuration files should not contain raw secrets. Use `secrets.directory` to
+load secret values from files into environment variables for integrations that
+read credentials from the environment.
 
 ## Maintained Examples