### Added
- New `GET /api/tools/env` endpoint to list all tool environment variables with their configuration status, sensitivity flag, and which tools use each variable. Sensitive values (API keys, secrets, tokens) are never exposed to the client.
- New `PUT /api/tools/env/:key` endpoint to set a tool environment variable value, persisted to `~/.jean2/.env` via atomic writes.
- New `DELETE /api/tools/env/:key` endpoint to clear a tool environment variable.
- New `tool-env` configuration module (`configuration/tool-env.ts`) with sensitivity detection (`isSensitiveEnvKey`) and safe value masking for the API responses.

### Fixed
- Tool calls no longer incorrectly show as "interrupted" when switching sessions. Orphaned tool call reconciliation now only runs for sessions that are not actively streaming.
