feat: manage env vars outside of deploy

[pat-s]

Follow-up from https://github.com/orgs/ricochet-rs/discussions/9.
Depends on ricochet-rs/ricochet#1228.

Env vars can only be supplied while deploying: ricochet app deploy --env resolves them (src/env_vars.rs), RSA-encrypts them against the server public key (src/crypto.rs) and sends them as a multipart field.
There is no way to list, change or remove them afterwards.
ricochet app settings update does not cover them either, since compute_patch (src/item/settings.rs:152) only diffs _ricochet.toml fields and env vars are deliberately not part of that file.

Proposal

Add a dedicated command group once the API sub-resource exists:

# list variable names, never values
ricochet app env list <item>
# set or update variables
ricochet app env set <item> KEY=value --env-file .env
# remove a variable
ricochet app env unset <item> KEY

Reuse parse_dotenv / resolve_env_vars and encrypt_env_vars so values are RSA-encrypted client-side and plaintext never reaches a request body or a log.

Tasks

• Add client methods for the env var endpoints in src/client.rs.
• Add the env subcommand group with list, set and unset, reusing the existing dotenv parsing and encryption helpers.
• Support --env-file alongside inline KEY=value pairs, matching deploy --env.
• Never print values in list, and say so in the help text.
• Tell the user whether a redeploy or restart is needed for the change to take effect, per the API decision.
• Fail with a clear message when the server predates the endpoints.
• Document the commands and cross-reference them from the settings update docs.