docs: add TweetClaw secret management example

[kriptoburak]

Summary

• Recommend env fallback so the 1claw agent key stays out of checked-in OpenClaw config.
• Add a companion plugin example for storing and rotating the Xquik API key used by TweetClaw.
• Clarify the boundary: 1claw manages the secret lifecycle while TweetClaw handles structured X/Twitter automation.

Validation

• npm ci --ignore-scripts --no-audit --no-fund
• npm run typecheck
• npm run build
• npm pack --dry-run --json
• git diff --check
• Added-line secret and dash scan
• Link checks: target repo, target issues, target pulls, 1claw site, 1claw docs, OpenClaw plugin docs, TweetClaw GitHub, ClawHub listing, xquik.com, dashboard.xquik.com; npm registry metadata for @1claw/openclaw-plugin and @xquik/tweetclaw resolved. npmjs.com web pages returned bot-protection 403 but registry metadata is available.