alpha-readiness: strip LAN IPs, provider-agnostic wizard labels, fix config path and clipboard

- Default API/STT/TTS URLs changed from Casey's LAN to 127.0.0.1
- Wizard labels renamed: "Bifrost URL" → "API Endpoint URL", provider-agnostic
- Config discovery and wizard persistence now use ~/.souveraine/ over CWD
- Clipboard copy: added OSC 52 fallback, visible error feedback on failure
- Cleaned souveraine.example.toml: removed leaked key and personal paths

souveraine.example.toml

@@ -4,8 +4,8 @@
 # === BIFROST INFERENCE ===
 [bifrost]
 # Bifrost is the OpenAI-compatible API gateway
-base_url = "http://10.10.20.120:3360"
-api_key = "sk-bf-ae0d5801-9936-4fa9-ac9e-e956ffce6cfa"
+base_url = "http://127.0.0.1:3360"
+api_key = ""  # Set via `souveraine auth set` or BIFROST_KEY env var
 virtual_key = ""  # x-bf-vk header if required by provider
 
 # Default model for conversation
@@ -97,7 +97,7 @@ preserve_recent = 2
 [memory]
 git_enabled = true
 auto_commit = true
-base_path = "~/.pi/unified"
+# base_path = "~/.souveraine/agents"
 
 # === WEBSOCKET SERVER ===
 [websocket]