Allow ntk to read the API key from an environment variable

[next-devin]

What happens now

ntk reads the API key from --apikey or config.yml.

The init and checkout commands can save a supplied API key to config.yml. Other commands do not rewrite the file.

There is no way for CI jobs or agents to provide the key through an environment variable without putting it in the command or configuration file.

What should happen

Allow the API key to be supplied through NTK_APIKEY.

Use this order:

1. --apikey
2. NTK_APIKEY
3. config.yml

If the key came from NTK_APIKEY, ntk must not copy it into config.yml.

The existing behavior for an explicitly supplied --apikey can remain unchanged.

How to verify

• Run a command with only NTK_APIKEY set. It should authenticate without asking for --apikey.
• Run init or checkout using NTK_APIKEY. The environment value should not appear in config.yml.
• Supply both --apikey and NTK_APIKEY. The command-line value should be used.
• Run without either value. ntk should continue to read the key from config.yml.

Done when

• All ntk commands can use NTK_APIKEY.
• Environment-supplied keys are never written to config.yml.
• Command-line values take priority over environment values.
• Existing config.yml behavior continues to work.
• Tests cover the three possible sources.

[next-devin]

@alexphelps same as #29 — asking for your blessing before any PR, plus one factual question that unblocks docs work elsewhere.

Proposed changes:

1. Env-var token. Allow the API key from an environment variable (e.g. NTK_APIKEY) so agents and CI never persist it. Today every validated run writes the key in plaintext to config.yml (conf.py:124-145).
2. Unignored-config warning. When config.yml exists inside a git repo and is not gitignored, print a warning. No behavior change beyond the message.
3. Target echo. Mutating commands (push, watch deletes, init) print the target store and theme ID before acting, so a wrong theme_id is visible before it writes.
4. README: document the dashboard OAuth-app creation steps end to end.

The question: what are the exact permission strings in the store admin's API Access app permissions? The docs currently disagree (theme:read/theme:write singular in some places, themes:read/themes:write plural in the theme-kit README and the skills manifest). Your answer settles NextCommerceCo/developer-docs#33 and the merged guides wording.