Fixes
- Fix: `.env` file now created automatically on first run from `.env.example` — previously it didn't exist and users had no way to configure PORT, API keys, etc.
- Fix: `.env`, `auth.json`, `sessions-auth.json` now stored in `APP_DIR` (user's working directory) instead of the npm cache. Logging in no longer loses auth state after package updates.
- Fix: Config editor correctly reads and saves `.env` to/from `APP_DIR`.