contrib/sni-router: split MTG_SECRET assignment from envsubst in examples

`MTG_SECRET=<placeholder> envsubst < ...` was shell-broken on literal
copy-paste — bash parses `<placeholder>` as redirection from a
non-existent file. Two-line `export MTG_SECRET=...` + plain envsubst
form removes the ambiguity. Applies to README, docker-compose.yml,
and the .example header.

contrib/sni-router/README.md

 #    - .env (or export)  →  DOMAIN=your.domain   # used by HAProxy + Caddy
 #    - render mtg-config.toml from the tracked template
 #      (the rendered file is gitignored — secret stays out of git):
-MTG_SECRET=<secret-from-step-2> envsubst < mtg-config.toml.example > mtg-config.toml
+export MTG_SECRET=...    # paste the hex secret from step 2
+envsubst < mtg-config.toml.example > mtg-config.toml
 #      (Or `cp mtg-config.toml.example mtg-config.toml` and edit ${MTG_SECRET}
 #      by hand if you don't have envsubst.)
 

contrib/sni-router/docker-compose.yml

 # Quick start:
 #   1. Set DOMAIN in a .env file next to this one (or export it)
 #   2. mtg generate-secret YOUR_DOMAIN   -> render mtg-config.toml:
-#        MTG_SECRET=<secret> envsubst < mtg-config.toml.example > mtg-config.toml
+#        export MTG_SECRET=...     # paste the hex secret
+#        envsubst < mtg-config.toml.example > mtg-config.toml
 #      (the rendered file is gitignored). See README.md for the cp+edit variant.
 #   3. docker compose up -d
 #

contrib/sni-router/mtg-config.toml.example

 #   1. Set DOMAIN=<your.domain> in .env (HAProxy + Caddy pick it up).
 #   2. Generate the secret:  mtg generate-secret --hex <your.domain>
 #   3. Produce mtg-config.toml — pick one:
-#        MTG_SECRET=<secret> envsubst < mtg-config.toml.example > mtg-config.toml
+#        export MTG_SECRET=...     # paste the hex secret
+#        envsubst < mtg-config.toml.example > mtg-config.toml
 #      or just copy and hand-edit `${MTG_SECRET}`:
 #        cp mtg-config.toml.example mtg-config.toml && $EDITOR mtg-config.toml