docs: clarify configuration source precedence

Add a section to configuration docs that explains precedence among environment variables, local config, global config, and defaults.

Author: mitre88

docs/configuration.md

@@ -40,6 +40,20 @@ If a setting is defined in both `poetry.toml` (local/project) and `config.toml`
 the local/project configuration takes precedence over the global configuration.
 {{% /note %}}
 
+## Configuration sources
+
+When a setting is set in multiple places, Poetry applies the following precedence
+(from highest to lowest):
+
+1. Environment variables (for example, `POETRY_VIRTUALENVS_CREATE`)
+2. The local `poetry.toml` file (created with `poetry config --local`)
+3. The global `config.toml` file
+4. The setting's default value
+
+For repository credentials (`http-basic.*`, `pypi-token.*`), Poetry may also read
+from `auth.toml` and the system keyring. Environment variables still take
+precedence over file-based values.
+
 {{% warning %}}
 Be mindful when checking in this file into your repository since it may contain user-specific or sensitive information.
 {{% /warning %}}