feat(config): expand environment variables in pgdog.toml and users.toml - #1493

Configuration files can now reference the process environment, so secrets
and per-environment values no longer have to be baked into the files on
disk:

```toml
[admin]
password = "${PGDOG_ADMIN_PASSWORD}"

[general]
shutdown_timeout = ${PGDOG_SHUTDOWN_TIMEOUT:-60000}
```

`$VAR` and `${VAR}` are substituted from the environment, `${VAR:-value}`
supplies a fallback, and `$$` is a literal `$`.

Lookups are lenient: a reference to a variable that isn't set is left in
the document verbatim rather than failing the load. `users.toml` is the
file most likely to contain a stray `$` — a password like `sup$rsecret`
keeps working instead of turning into a startup failure or, worse, a
silently truncated credential. The one behaviour change to be aware of is
that a literal `$$` in an existing value now collapses to a single `$`;
that is unavoidable once any escape exists.

Expansion runs on the document source before it is parsed, so a variable
is interpolated as TOML rather than as a string. `${PASSWORD}` in value
position still needs its surrounding quotes, and a value containing `"`
or a newline will change how the rest of the document parses. This is
what allows bare `shutdown_timeout = ${VAR}` to work, and it is
documented on `expand`.

Implementation notes:

- New `pgdog-config::expand` module. `expand()` is infallible and returns
  `Cow::Borrowed` when there is nothing to substitute, so the common case
  costs no allocation.
- `FromToml::from_toml` replaces bare `toml::from_str` at the three sites
  that parse config text read from disk: both branches of
  `ConfigAndUsers::load` and `bootstrap_logger`. Every other
  `toml::from_str` in the tree parses a test literal, where expansion is
  unwanted, and is untouched.
- The trait carries a blanket impl over `DeserializeOwned`, so no
  per-type boilerplate is needed. `from_toml`, not `from_str`, to avoid
  colliding with the crate's many `std::str::FromStr` impls.
- `Error::config` now receives the expanded text, so the line numbers it
  reports stay correct when a variable's value contains a newline.
- `ConfigAndUsers` keeps `config_text`/`users_text` as the raw,
  unexpanded source. Resolved secrets must not be written back to disk
  when the config is reloaded or backed up.

Adds a dependency on `shellexpand`.

Configuration files can now interpolate the contents of a file, so a
secret mounted into the container never has to be copied into an
environment variable to reach `pgdog.toml`:

```toml
[admin]
password = "${file./run/secrets/admin_password}"
```

Environment references move under an `env.` prefix at the same time:
`${env.VAR}` where it used to be `${VAR}`. Both prefixes are required,
so a plain `${VAR}` is now literal text. The two forms are otherwise
identical — `${env.VAR:-value}` and `${file.PATH:-value}` both supply a
fallback, and `$${env.VAR}` is still a literal `${env.VAR}`.

This is a breaking change to syntax introduced in the two commits right
before it and never released, so nothing in the wild depends on the
unprefixed form. The namespace is what makes a second reference kind
possible without guessing at the target from its shape, and it widens
the set of values that pass through untouched: a `${...}` that isn't one
of the two known prefixes is left alone rather than being treated as a
lookup that happened to miss.

File references are strict where environment references are lenient. An
unset variable is left in the document verbatim, because `users.toml` is
full of values that may legitimately contain a `$` and failing the load
on one would be worse than leaving it be. A `file.` reference names a
path the operator wrote down on purpose, so a file that can't be read is
an error — `Error::FileReference`, carrying the path and the underlying
`io::Error` — unless a fallback is given. A silently empty password is
the failure mode worth avoiding here.

Trailing newlines are trimmed from file contents. Secret managers and
`echo` alike conventionally leave one behind, and since expansion runs on
the document source before it is parsed, that newline would otherwise
land in the middle of a TOML string and change how the rest of the
document parses.

Implementation notes:

- `expand()` now returns `Result<Cow<'_, str>, Error>`; it still returns
  `Cow::Borrowed` when the source contains no `${`, so the common case
  costs no allocation. `FromToml::from_toml` propagates the error.
- A `Reference` enum carries the parsed target, so the recognition step
  stays where the `}` is found and the substitution step just matches on
  what was recognised.
- `is_path` is deliberately loose — non-empty, no whitespace, no `$` or
  `{`. It exists to decide reference-or-literal, not to validate a path;
  anything stricter would reject paths that the filesystem accepts, and
  `read_to_string` reports the real answer anyway.
- Only trailing `\r` and `\n` are trimmed, not interior newlines or
  trailing spaces, both of which can be part of a secret.
- Tests write real files with `tempfile` rather than mocking the read,
  which keeps the newline-trimming and missing-file cases honest.