cli: smpy new writes generated secrets into the committed .env.example #441

What happened

smpy new (0.0.35) generates real values for SM_SECRET_KEY, SM_USERS_RESET_PASSWORD_TOKEN_SECRET and SM_USERS_VERIFICATION_TOKEN_SECRET and writes them into .env.example (app_project.py ~L153-166). The scaffolded .gitignore ignores .env but not .env.example, so the first commit of every new app publishes its session/token secrets, and the user is told to cp .env.example .env, so dev and anything deployed from that copy share the leaked keys.

Expected

.env.example keeps empty placeholders; the CLI writes the generated secrets to .env (gitignored), creating it if absent. Secrets being optional at runtime for SM_SECRET_KEY already covers the empty-example case.

Repro

uvx --from simple_module_cli@0.0.35 smpy new demo --yes --no-install && grep SECRET demo/.env.example

Still present on main (8f48ef4).