docs: add encrypted environment variables technical spec

Describes the X25519 + AES-256-GCM scheme used to protect app
environment variables, including key derivation from KMS, the
.appkeys.json file format, and cross-language encrypt/decrypt
implementation guides (Rust, Go, Python, TypeScript).

Author: Leechael