docs(ocm): refresh env and CLI guides and redact internal settings secrets - #398

Summary

Refreshes the environment, contribution, and ocm CLI documentation, and redacts stored credentials from the internal settings API.

• .env.example documents previously undocumented options (OPENCODE_HEALTH_*, OPENCODE_BIN, REPO_BROWSE_ROOT, PREVIEW_PORT) and corrects PASSKEY_ORIGIN for Vite dev, the sandbox image digest pin, and the SANDBOX_EXEC_USER default.
• CONTRIBUTING.md adds type-checking and commit-message conventions; README.md refreshes the feature list and the ocm CLI description.
• ocm-cli/README.md and ocm-cli/bin/ocm.ts document ocm login, the install layout, --version/--help and aliases, push/pull safety prompts, the <host> · <repo> indicator, and the /ocm-goal and /ocm-multirun flows.
• The internal settings routes replace stored credentials (git tokens, SSH keys and passphrases, TTS/STT API keys, server env var values, last known good config) with <redacted>; empty values stay empty so a caller can still tell whether a credential is set. Applies to GET and PATCH.
• scripts/setup-dev.sh no longer creates the unused workspace/config directory.

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation

Checklist

• Code follows project style (no comments, named imports)
• TypeScript types are properly defined
• Tests added/updated (80% coverage target)
• pnpm lint passes locally
• pnpm typecheck passes locally

Backend typecheck is clean and pnpm lint reports 0 errors (41 pre-existing no-explicit-any warnings). backend/test/routes/internal-settings.test.ts passes (21 tests), including a new case asserting GET redacts stored credentials, keeps empty ones empty, and leaks no secrets; the PATCH test now asserts the response is redacted while the stored value is unchanged.