When an environment variable is need to run an app #304

Some apps wrap gated models from huggingface hub that need a HF secret at runtime. For example, app-pyannotesd-wrapper needs an HF_TOKEN to load the gated pyannote/speaker-diarization-3.1 pipeline.

Both current options are bad:

• runtime parameter: sign_view stamps it into the output MMIF (secret leak), and it rides the HTTP request;
• bare env var: works, but nothing in the metadata declares it, so the requirement is invisible to users.

Idea: let an app declare required environment/secret configuration in its metadata, so it's discoverable (app directory, --help) yet never routed through runtime params or written to the output MMIF.

The concrete mechanism (a new metadata field, a secret flag on parameters, optional startup validation, etc.) is open for discussion.