Moving Shell Secrets from .zshrc to 1Password CLI

API keys sitting in plaintext dotfiles are one accidental push away from leaking. 1Password CLI can load them at shell startup with biometric unlock — no more secrets in git history, no more rotating tokens after a bad commit.