feat: hulak env migrate — convert env/*.env to encrypted store (#143)

[xaaha]

Summary

• Add hulak env migrate command that converts env/*.env files into .hulak/store.age
• Refactor LoadEnvVars → extract LoadEnvVarsRaw for $VAR-preserving parsing
• Extract bootstrapVault helper, reuse in InitVaultProject (−15 lines)
• Update hulak migrate env references → hulak env migrate

Behavior

• Scans env/ for *.env files, parses each with LoadEnvVarsRaw
• Existing store values win on conflicts (re-running is safe/idempotent)
• $VAR values stored as literals — resolved at runtime by resolveEnvRefs
• Non-.env files skipped with warning
• Empty .env files create empty sections
• env/ directory NOT deleted — user does that manually
• Recovery key warning only on first-time keypair generation

Test plan

• Single/multiple .env file migration
• Existing store wins on key conflicts
• $VAR preserved as literal string
• Non-.env files skipped
• Empty .env creates empty section
• Error: env/ missing
• Error: env/ is a file
• LoadEnvVarsRaw preserves raw values + type inference
• LoadEnvVars regression: still resolves $VAR
• mise check — 0 lint issues, all tests pass

Closes #143