* [self-hosted] Override relay auth secret and store encryption key from the environment
Combined server.authSecret and server.store.encryptionKey could only be
set in YAML, so operators could not keep config.yaml in git without
secrets. A non-empty NB_AUTH_SECRET or NB_STORE_ENCRYPTION_KEY now
overrides those fields after YAML is parsed and before defaults and
validation, matching the standalone relay env name for the auth secret.
* [self-hosted] Cover secret env overrides when no config path is given
LoadConfig with an empty path starts from DefaultConfig and applies
NB_AUTH_SECRET and NB_STORE_ENCRYPTION_KEY without reading YAML. The
existing tests only used YAML paths, so that branch had no coverage.
