docs: Clarify secret access, production storage, and Cloud secrets

[developerjamiu]

Closes #653.

The configuration docs explained how to declare secrets but not how to read them, which left a few recurring questions unanswered (the most common: "can I use getPassword in my Flutter app?"). This adds three subsections to the Secrets section of 07-configuration.md:

• Accessing Secrets in Code — secrets are server-side only and never reach the Flutter app. Read them with session.passwords['name'] / session.serverpod.getPassword('name') inside endpoints, or pod.getPassword('name') at startup. The stripeApiKey example threads through from where it's declared above.
• Secrets in Production — config/passwords.yaml and credential files are gitignored by default; in production, set secrets via SERVERPOD_PASSWORD_* env vars or your host's secret manager.
• Secrets on Serverpod Cloud — short pointer to scloud password set (with --from-file for JSON credentials), linking to the Cloud passwords/secrets reference for the full story.

Scope is deliberately the configuration page plus a cross-link; the Cloud side is already covered in the Cloud docs, so this doesn't duplicate it.

Verification

• getPassword / session.passwords against framework source (serverpod.dart, session.dart); confirmed no getPassword in serverpod_client (server-side only).
• Default .gitignore entries for passwords.yaml and firebase_service_account_key.json against the starter template.
• The Cloud scloud password set / --from-file round-trip run against a live Cloud project (set, listed as SET (User), encrypted).
• Docs build passes; no broken links.