security: remove hardcoded database credentials and auth secrets

- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety

This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.

.env.example

@@ -1,2 +1,10 @@
 PORT=5000
 MONGO_URI=mongodb://localhost:27017/deathwatch
+
+# Database credentials - CHANGE THESE IN PRODUCTION
+DB_PASSWORD=your_secure_database_password_here
+
+# Authentication secrets - CHANGE THESE IN PRODUCTION
+GM_SECRET=your_secure_gm_secret_here
+GM_PASSWORD=your_secure_gm_password_here
+PLAYER_PASSWORD=your_secure_player_password_here