cli: avoid data-dir initialization for version; create db parent dirs; redact generated passwords in CLI output

- Prevent 'nx9-wg version' from creating data directories by avoiding database initialization.
- Create parent directories when an explicit --database path is provided.
- Redact printed generated administrator passwords; announce file path or redact instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -0,0 +1,44 @@
+# ==============================================================================
+# NX9 WireGuard - Environment Variables Example (.env.example)
+#
+# All environment variables for nx9-wg MUST use the NX9_WG_ namespace prefix.
+# ==============================================================================
+
+# Path to the TOML configuration file
+NX9_WG_CONFIG=/etc/nx9-wg/config.toml
+
+# Directory where persistent SQLite database and state files are located
+NX9_WG_DATA_DIR=/var/lib/nx9-wg
+
+# Specific database path or sqlite connection URL
+NX9_WG_DATABASE=/var/lib/nx9-wg/nx9-wg.db
+
+# Directory where database backup archives and manifests are saved
+NX9_WG_BACKUP_DIR=/var/lib/nx9-wg/backups
+
+# Maximum number of automated backups to retain
+NX9_WG_BACKUP_MAX_COUNT=10
+
+# Optional cron schedule for automated backups (e.g. 02:00 daily: "0 2 * * *")
+# NX9_WG_BACKUP_SCHEDULE="0 2 * * *"
+
+# Host and port for the Axum REST API and WebSocket daemon
+NX9_WG_LISTEN_ADDR=0.0.0.0:8080
+
+# Logging verbosity level (trace, debug, info, warn, error)
+NX9_WG_LOG_LEVEL=info
+
+# Inactivity expiration in hours for web administrator sessions
+NX9_WG_SESSION_TIMEOUT=24
+
+# Interval in seconds between background kernel reconciliation cycles
+NX9_WG_RECONCILIATION_INTERVAL=30
+
+# Initial administrator bootstrap username (default: admin)
+NX9_WG_ADMIN_USERNAME=admin
+
+# Initial administrator bootstrap password (secret: used once at init only)
+# NX9_WG_ADMIN_PASSWORD=ReplaceWithStrongPassword123!
+
+# Path to file containing administrator bootstrap password (Docker secret / vault)
+# NX9_WG_ADMIN_PASSWORD_FILE=/run/secrets/nx9_wg_admin_password