Make env + keyring the recommended secret source (docs + code path)

[thenotespublisher]

Impact: reduces accidental token-in-file commits and syncing.
Recommend env var by default in README; add optional OS keyring support I suggest github.com/zalando/go-keyring and doc examples for macOS/Windows/Linux. Implement keyring fallback: if not in env, try keyringg