Settings, env & secrets
Load config from TOML + environment, resolve secrets.
config layers config/default.toml → config/{env}.toml → env-var overrides into a typed Settings struct. env gives typed readers (required, with_default, list, duration_secs). secrets is a pluggable backend (EnvSecrets, InMemorySecrets, or Vault/cloud via the trait).
let port: u16 = env::with_default("PORT", 8080);
let url = env::required("DATABASE_URL")?;