Stop passing secrets as plaintext Docker env vars

[michaelzwang13]

orchestrator.create_agent() injects LLM_API_KEY, MOONSHOT_API_KEY, OPENCLAW_GATEWAY_TOKEN, and others as container environment variables — visible via docker inspect and in crash logs.

Scope

• The AWS CDK work (AWS deployment via CDK #11) addresses production via Secrets Manager, but local containers stay exposed.
• Mount secrets as files / use Docker secrets, or scope down what each container receives.

Lower priority (local-only exposure) but a real one.