Play Framework

refactor: move PLAY_SECRET .env from project root to certs/.env (PF-71, release 1.12.22)

PF-69 unified the TLS cert location at certs/. PF-71 extends that grouping
to the application secret so every piece of runtime security material lives
under one canonical directory. After this change, play new, play secret,
jclaw.sh secret, and the Docker compose entrypoint all read and write the
same certs/.env path — no more two-location asymmetry depending on which
path the operator took to set the secret.

Scope:
- framework/pym/play/utils.py: writeEnvVar default flips to certs/.env, makes
  parent dirs as needed, and chmods the file to 0600 (production-grade
  hardening that doesn't depend on umask). loadDotEnv prefers certs/.env
  with a back-compat fallback to legacy .env at the project root, gated by
  a one-line WARN telling operators to migrate.
- framework/pym/play/commands/secret.py: HELP text updated; play secret now
  emits a friendly "delete the legacy .env" nudge when both files coexist
  briefly during migration.
- framework/pym/play/application.py: comment updated to reflect new path.
- resources/application-skel/.gitignore: ignore /certs/ (TLS material +
  secret env file all live there post-PF-69 + PF-71). Legacy /.env line
  kept for back-compat during the transition.
- resources/application-skel/conf/application.conf: comment updated to
  point at certs/.env.
- framework/test-src/cli/test_cli.py: new TestPlaySecret class — 4 tests
  covering the AC (file lives at certs/.env, root .env doesn't exist,
  .env.example stays at root, mode 0600, re-run preserves unrelated lines).

Decision: .env.example stays at project root. It's a committed template
documenting required env vars, not a secret — moving it to certs/ would
break the cp .env.example certs/.env onboarding pattern and confuse the
"certs/ = runtime security material" semantics established by PF-69.

End-to-end verified on /tmp/pf71test (with PF-70 fix in place):
- play new writes secret to certs/.env mode 0600; legacy ./.env not created
- play start boots cleanly, no "Cannot replace PLAY_SECRET" errors
- Legacy ./.env layout: framework reads it with WARN, app boots fine
- play secret on legacy app writes new key to certs/.env, prints nudge
  about deleting the legacy file
- After mv, WARN/nudge disappear — clean steady state

Migration: operators with an existing ./.env should mv it to certs/.env
once. The framework reads the legacy path with a WARN until then, so apps
keep booting either way.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>