docs: document built-in env variables and encryption

[Leechael]

Summary

• Rewrite the "Secure Environment Variables" page → "Environment Variables" with two sections: Encrypted Secrets and Built-in Environment Variables
• Add client-side encryption explanation (X25519 + AES-256-GCM, server never sees plaintext)
• Document full-replacement update semantics (cannot update a single variable)
• Document all built-in variables injected by the default pre-launch script: private registry auth (DSTACK_DOCKER_*), AWS ECR auth (DSTACK_AWS_*), root access (DSTACK_ROOT_*, DSTACK_AUTHORIZED_KEYS), and app metadata (DSTACK_APP_*)
• Clarify that built-in variables depend on the default pre-launch script and won't be available if replaced via --pre-launch-script

Test plan

• Verify page renders correctly in Mintlify preview
• Check all internal links resolve (--pre-launch-script CLI reference link)
• Verify external link to dstack-examples repo is valid