docs: replace dead trello.com/app-key credential flow

[piggyatbaqaqi]

Problem

trello.com/app-key no longer issues standalone API keys — it redirects to the Power-Up admin. The README, .env.template, and example.env all still point there, so new users following the setup instructions dead-end on the very first step.

The recovery path isn't self-evident either. I hit all three of these getting the server running:

1. An API key now requires a Power-Up. Not obvious that you must create one when you only want REST access and will never render UI inside Trello.
2. "Iframe connector URL" looks mandatory. It reads as though you need to host something on a public server. You don't — leaving it blank is correct for an API client, but nothing says so.
3. The "Secret" beside the API key is not the token. It's the OAuth 1.0 client secret. Both it and a real token are 64 lowercase hex characters, so it's a natural thing to grab, and it fails authentication with a misleading invalid key from the API.

Changes

• README.md — new #### Getting your API key and token section with the current five-step flow, an explicit note that the Iframe connector URL can be left blank, and a callout distinguishing the Secret from the token. The install section now links to it instead of repeating instructions.
• .env.template — corrected the stale link comment.
• example.env — corrected the API key link. It already carried the right /1/authorize URL for the token; only the key link was wrong.

Docs only, no behaviour change. tsc --noEmit passes.

Notes

Verified end to end against a live board: created a Power-Up with a blank iframe URL, generated a key and token by these exact steps, and confirmed the server connects and its tools work (add_comment and update_card_details both exercised over stdio).

One incidental finding, not addressed here: CONTRIBUTING.md step 5 says to run npm run lint, but there's no lint script in package.json. Happy to open a separate PR if you'd like it added or the instruction dropped.

Disclosure

This change was written with AI assistance (Claude, via Claude Code), directed and reviewed by me. The commit carries a Co-Authored-By: trailer to that effect. I'm flagging it here as well so it's visible up front rather than only in the git metadata — happy to adjust the attribution to whatever form you prefer for this project.