feat(config): expand env vars in config.toml keys/values and trust matching

[brianm-openai]

• Expand env vars in config.toml string values and table keys.
• Surface expansion warnings across app-server, TUI, and exec/CLI.
• Match project trust via expanded + normalized keys (including bare ~ and $HOME).
• Prefer updating symbolic project keys; remove absolute duplicates when they only contain trust_level.
• Add/extend tests for symbolic trust keys and trusted project layer enablement.
• Added expansion.md for future agents to understand the goal.
• Update docs/config.md and expansion.md.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[brianm-openai]

I have read the CLA Document and I hereby sign the CLA

[brianm-openai]

recheck