fix(zsh): source KAGI_API_KEY and HF_TOKEN from 600-perm secret files

Keys live in ~/.config/secrets/{kagi_api_key,hf_token}; .zshrc only reads
them, so the literals leave the shell rc that this repo publishes to Gitea.

dotfiles/zz-blankpad/zsh/.zshrc

@@ -1,3 +1,6 @@
 source /usr/share/cachyos-zsh-config/cachyos-config.zsh
 
+[ -f ~/.config/secrets/kagi_api_key ] && export KAGI_API_KEY="$(cat ~/.config/secrets/kagi_api_key)"
+[ -f ~/.config/secrets/hf_token ] && export HF_TOKEN="$(cat ~/.config/secrets/hf_token)"
+
 [ -d "$HOME/.bun/bin" ] && export PATH="$HOME/.bun/bin:$PATH"