Enhance secrets CLI to support additional secret file types and clear command

- Updated file tracking to include `.dev.vars` alongside `.env` and `.env.*`.
- Improved pre-commit hook to block plaintext secret files, including `.dev.vars`.
- Added `clear` command to remove plaintext secret files from the current directory and workspaces.
- Enhanced tests to cover new functionality for `.dev.vars` and the `clear` command.
- Updated documentation to reflect changes in tracked files and command usage.

hooks/pre-commit

@@ -3,9 +3,9 @@
 # Rejects staged files matching .env patterns without .age extension.
 # This is a safety net, not a security boundary (--no-verify bypasses it).
 
-BLOCKED=$(git diff --cached --name-only | grep -E '\.env' | grep -v '\.age$' || true)
+BLOCKED=$(git diff --cached --name-only | grep -E '\.(env|dev\.vars)' | grep -v '\.age$' || true)
 if [ -n "$BLOCKED" ]; then
-  echo "ERROR: Plaintext env files staged for commit:"
+  echo "ERROR: Plaintext secret files staged for commit:"
   echo "$BLOCKED"
   echo "Only .age (encrypted) files should be committed."
   exit 1