Prefer DB4S dotenv files for SQLCipher passwords

Use a local .db4s.env when present, otherwise preserve legacy local .env
lookup before walking parents for .db4s.env.

Co-authored-by: Cursor <cursoragent@cursor.com>