feat: keep API keys out of git

[yepzdk]

Agent Proxy writes API keys in plain text, and with itkdev-docker it was writing them into the tracked traefik/dynamic-conf.yaml of a public repository. itk-dev/devops_itkdev-docker#157 gives Traefik an untracked traefik/dynamic.d/ directory; this PR makes Agent Proxy fit that setup and catch the same mistake elsewhere.

• A warning shows above the service list while the config is in a git repository and not ignored. The check looks for .git before running git, because /usr/bin/git on a Mac without the developer tools opens an install prompt; without git there is no warning. In directory mode it checks a would-be service.yml, so a .gitignore that lists service files one by one still warns.
• Empty and comment-only files in a config directory, such as itkdev-docker's bind-mount placeholder, are no longer listed as unmanaged services. Unreadable files still are, since one broken file makes Traefik reject the whole directory.
• The README describes the itkdev-docker setup and why Traefik must watch the directory Agent Proxy writes to directly.

Merge after itk-dev/devops_itkdev-docker#157.