feat(web-env): store staging secrets in 1Password

[RSO]

Summary

• store sensitive Staging values in the same 1Password item as Production using a concealed password (staging) field
• allow either Staging or Production to create the item first, then add the missing environment field later
• preserve and update existing Staging fields by label even when 1Password generated their field ID
• document the combined item layout and expand focused 1Password template coverage

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed all 4 changed files of this stacked PR (based on #5334): the VaultEnvironment split of setVaultValue, the staging/production field helpers, the index.ts vault loop, and the expanded 1Password template tests and docs are internally consistent, correctly handle all create/edit field combinations, and introduce no leaks, security issues, or logic errors in changed code.

Files Reviewed (4 files)

• DEVELOPMENT.md
• scripts/web-env/index.ts
• scripts/web-env/shared.test.ts
• scripts/web-env/shared.ts

---

_{Reviewed by kimi-k3 · Input: 42.3K · Output: 6.2K · Cached: 321K}

_{Review guidance: REVIEW.md from base branch iterate-on-webenv-command-2}