[self-hosted] Override relay auth secret and store encryption key from the environment (#8405)

* [self-hosted] Override relay auth secret and store encryption key from the environment

Combined server.authSecret and server.store.encryptionKey could only be
set in YAML, so operators could not keep config.yaml in git without
secrets. A non-empty NB_AUTH_SECRET or NB_STORE_ENCRYPTION_KEY now
overrides those fields after YAML is parsed and before defaults and
validation, matching the standalone relay env name for the auth secret.

* [self-hosted] Cover secret env overrides when no config path is given

LoadConfig with an empty path starts from DefaultConfig and applies
NB_AUTH_SECRET and NB_STORE_ENCRYPTION_KEY without reading YAML. The
existing tests only used YAML paths, so that branch had no coverage.

combined/config.yaml.example

@@ -45,7 +45,8 @@ server:
       email: ""
       awsRoute53: false
 
-  # Shared secret for relay authentication (required when running local relay)
+  # Shared secret for relay authentication (required when running local relay).
+  # Can also be set via NB_AUTH_SECRET; a non-empty value overrides this field.
   authSecret: "your-secret-key-here"
 
   # Data directory for all services
@@ -112,6 +113,8 @@ server:
   store:
     engine: "sqlite"  # sqlite or postgres
     dsn: ""  # Connection string for postgres
+    # Store field encryption key. Can also be set via NB_STORE_ENCRYPTION_KEY;
+    # a non-empty value overrides this field.
     encryptionKey: ""
     # file: ""  # Custom SQLite file path (optional, defaults to {dataDir}/store.db)