Move every hard-coded secret out of the code

/goal no API key, token, password or private key is hard-coded in tracked files. Search with `git grep -nE` for long random-looking strings, private key headers and names like key, secret, token and password with a literal value, and show the search and its results. Move each real secret to an environment variable read at startup with a clear error when missing, add the names with placeholder values to .env.example, and make sure .env is in .gitignore. To prove it: run the same `git grep -nE` search again and show it has no real secrets left, and run `npm test` and show it exits 0. Constraints: never print a secret value in the conversation (show only the file, line and variable name), do not rewrite git history, and list every secret that must be rotated because it was committed. Or stop after 15 turns.