Stop describing dev as the default environment

Comments in reqtls and session, and the README Quick Start and
deployment checklist, still spoke as if an unset WEBHOOKER_ENVIRONMENT
meant dev. The checklist now asks only that the environment is not dev
(unset or prod); the Quick Start describes running from the clone.

Model: opus-5-5

internal/reqtls/reqtls.go

@@ -5,7 +5,7 @@
 // several packages, by hand, and the answers disagreed. The session
 // cookie's Secure attribute was decided at startup from the configured
 // environment while the CSRF cookie's was decided per-request, so a
-// deployment behind a TLS proxy in the default environment emitted one
+// deployment behind a TLS proxy in the dev environment emitted one
 // Secure cookie and one non-Secure cookie on the same response.
 // Everything kept working, which is exactly why nobody noticed.
 //