docs: add environment variables section to CLI reference

[Mossaka]

Summary

The CLI reference has no environment variables section. The CLI reads several env vars for auto-detection and credential management.

Missing environment variables

Auto-detection variables

Variable	Purpose
GITHUB_SERVER_URL	Auto-detects GHEC tenants (*.ghe.com) to add to domain allowlist
GITHUB_API_URL	Auto-detects GHEC API domains for allowlist
ENGINE_API_TARGET	Auto-detects GHES domains (e.g., api.github.mycompany.com)

API target overrides (also settable via CLI flags)

Variable	Default	Purpose
COPILOT_API_TARGET	api.githubcopilot.com	Copilot API endpoint override
OPENAI_API_TARGET	api.openai.com	OpenAI API endpoint override
OPENAI_API_BASE_PATH	-	OpenAI API base path (e.g., /serving-endpoints)
ANTHROPIC_API_TARGET	api.anthropic.com	Anthropic API endpoint override
ANTHROPIC_API_BASE_PATH	-	Anthropic API base path

Audit

Variable	Purpose
AWF_AUDIT_DIR	Fallback audit directory when --audit-dir not specified

Credential variables (used by API proxy sidecar)

Variable	Purpose
OPENAI_API_KEY	OpenAI API key — held securely in api-proxy sidecar
ANTHROPIC_API_KEY	Anthropic API key — held securely in api-proxy sidecar
COPILOT_GITHUB_TOKEN	GitHub Copilot token — held securely in api-proxy sidecar

These credentials are never exposed to the agent container when --enable-api-proxy is active.