CLI Extensions — Stage 3: App-config schema, derive macro, env-overlay loader #262

Part of the EdgeZero CLI Extensions effort — stage 3 of 8.

Scope: add edgezero-core::app_config — AppConfigMeta trait, SecretField / SecretKind, AppConfigLoadOptions, and load_app_config / load_app_config_with_options (+ _raw variants) with environment-variable overlay resolution (<APP_NAME>__<SECTION>__<KEY>, __ separator, override-existing-keys-only, deterministic ambiguity rejection). Add the #[proc_macro_derive(AppConfig, attributes(secret))] macro in edgezero-macros with #[secret] / #[secret(store_ref)] and compile-error constraints. Add generator templates for <name>.toml and <name>-core/src/config.rs (with #[serde(deny_unknown_fields)]; common-case #[secret] only, no store_ref). Add examples/app-demo/app-demo.toml + AppDemoConfig.

Ship gate: AppDemoConfig::SECRET_FIELDS matches; load_app_config::<AppDemoConfig> succeeds; an env var overrides a nested value in a test.

Design spec: §9, §6.7, §6.8, §6.10 — Implementation plan: Stage 3.