Username lives in .env only: drop bgg_username from config.toml

load_config no longer reads a bgg_username toml key — BGG_USERNAME in
the environment is its single home (public, but the account should have
exactly one). Docs, messages, and tests updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/bggpipe/config.py

@@ -1,8 +1,9 @@
-"""Configuration: config.toml at the project root, env vars override.
+"""Configuration: non-secret knobs from config.toml at the project root.
 
-Secrets (ANTHROPIC_API_KEY, BGG_PASSWORD) are never stored here — they are
-read from the environment at the point of use and must never be written to
-disk or logs.
+Everything account-related lives in the environment (.env via direnv):
+secrets (ANTHROPIC_API_KEY, BGG_PASSWORD, BGG_API_TOKEN) because they must
+never touch disk or logs, and BGG_USERNAME — public, but kept there so the
+account has exactly one home.
 """
 
 from __future__ import annotations
@@ -46,7 +47,6 @@ def load_config(path: Path | None = None) -> Config:
     if p.exists():
         raw = tomllib.loads(p.read_text())
         known = {
-            "bgg_username": str,
             "photos_dir": Path,
             "data_dir": Path,
             "model": str,

src/bggpipe/upload.py

@@ -499,7 +499,7 @@ def run_upload(
 
 def _run_verify(cfg: Config, client: BGGClient | None, log_path: Path) -> None:
     if not cfg.bgg_username:
-        typer.echo("--verify needs bgg_username (config.toml or BGG_USERNAME).")
+        typer.echo("--verify needs BGG_USERNAME in the environment.")
         return
     client = client or BGGClient(cfg.cache_dir, cfg.rate_limit_seconds)
     try: