Scrub example config of real credentials and internal hosts (closes #172)

config.example.yml carried a real-looking 20-char S3 access key id and
40-char secret, a private-address http:// endpoint, and a storage_url
naming an internal rclone remote and pool path. Replace them with the
same neutral placeholders the `config init` template uses:
YOUR_ACCESS_KEY / YOUR_SECRET_KEY, a https://s3.example.com endpoint,
a mybucket bucket, and rclone://myremote/path/to/backups. No behavior
or other keys change.

The credentials live in the commented-out s3 block, which the loader
never parses, so the new test reads the file's raw text to assert the
placeholders are present and no http:// endpoint remains, and also
loads it to confirm the active storage_url still parses.

Model: opus-4-8

internal/config/config_test.go

@@ -87,6 +87,48 @@ func TestConfigLoad(t *testing.T) {
 	}
 }
 
+// TestExampleConfigIsScrubbedAndLoads checks that the shipped
+// config.example.yml carries only neutral placeholders (no real credentials,
+// private addresses, or internal host names) and still parses.
+func TestExampleConfigIsScrubbedAndLoads(t *testing.T) {
+	t.Parallel()
+
+	examplePath := filepath.Join("..", "..", "config.example.yml")
+
+	cfg, err := Load(examplePath)
+	if err != nil {
+		t.Fatalf("Failed to load config.example.yml: %v", err)
+	}
+
+	if cfg.StorageURL != "rclone://myremote/path/to/backups" {
+		t.Errorf("Expected neutral storage_url, got '%s'", cfg.StorageURL)
+	}
+
+	//nolint:gosec // G304: examplePath is a fixed in-repo path, not user input
+	raw, err := os.ReadFile(examplePath)
+	if err != nil {
+		t.Fatalf("Failed to read config.example.yml: %v", err)
+	}
+
+	text := string(raw)
+
+	wantSubstrings := []string{
+		"YOUR_ACCESS_KEY",
+		"YOUR_SECRET_KEY",
+		"endpoint: https://",
+	}
+	for _, want := range wantSubstrings {
+		if !strings.Contains(text, want) {
+			t.Errorf("Expected config.example.yml to contain %q", want)
+		}
+	}
+
+	// A raw "http://" scheme would mean a plaintext, likely private endpoint.
+	if strings.Contains(text, "http://") {
+		t.Error("config.example.yml should not contain an http:// endpoint")
+	}
+}
+
 // TestConfigFromEnv tests loading config path from environment variable
 func TestConfigFromEnv(t *testing.T) {
 	t.Parallel()