Catch exposed secrets and leftovers in Postman environments

**Objective:** Review the variables in environments whose name contains `{environment-name}` (default: all environments) and report hygiene problems, without ever echoing a secret value.

**Step 1: Load the environments**

Call `postman-get-environments`, using `name.contains` = `{environment-name}` when it is given. Keep name, environment-id, public, owner and updated-at.

**Step 2: Load the variables**

For each environment, call `postman-get-environment-variables` with `environment-id`. Keep key, value, enabled and environment-public.

**Step 3: Check each variable**

* Secret-like: the key contains token, secret, password, passwd, apikey, api_key, api-key, auth, bearer, private or credential (any case). A secret-like key with a non-empty value in a public environment is the most serious finding.
* Empty: enabled is true but value is empty. Requests using it will send a blank.
* Disabled: enabled is false. Usually leftover; list it as clean-up.
* Duplicated keys: the same key twice in one environment.
* Placeholder values: values such as changeme, todo, xxx, <your key>.

**Step 4: Report**

Group by environment, most serious first. For each finding give environment, key, problem and a suggested fix. For secret-like keys show the value masked as the first 2 characters followed by ***. End with totals per problem type.

**Rules & Guidelines:**

* NEVER print a full variable value whose key looks secret, and do not print any value longer than 40 characters in full.
* This is read-only. Do NOT call `postman-update-environment`, `postman-add-environment` or any other add, update, run, fork, merge or publish tool. There is no tool here that edits a variable; tell the user to fix variables in Postman.

**Validation:**

* If no environment matches, list the environment names that do exist and stop.
* If an environment has no variables, list it as empty rather than skipping it.