Secrets-free .env with 1Password CLI and DDEV

How to replace .env credentials with 1Password references so nothing sensitive ever touches your local filesystem.