docs: settings pull-through after #207 - secrets file path on Windows and with XDG in the 1Password how-to; 1Password approval is per terminal session, not per value

Files changed:
- docs/explanation/configuration-tiers.md
- docs/how-to/use-1password-for-settings.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2

docs/explanation/configuration-tiers.md

@@ -76,8 +76,9 @@ What limits the exposure without preventing it:
 
 - a 1Password vault of its own for this instance's entries, so an unlocked `op` reaches nothing
   else;
-- the approval prompt of the 1Password desktop app, which asks a human before each new process
-  reads a value;
+- the approval prompt of the 1Password desktop app, which asks a human before the CLI may read
+  anything - per terminal session, not per value, so it stops a session nobody approved and not
+  one that already was;
 - in CI, a service account that sees only that vault.
 
 The rule in [AGENTS.md § Settings](../../AGENTS.md#settings) - a secret never passes through the