security: remove hardcoded database credentials and auth secrets

- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety

This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.

database/scripts/reset_pw_andreas_chris.js

@@ -18,7 +18,7 @@ const { playerHelpers } = require('../sqlite-db');
     fs.writeFileSync(beforePath, JSON.stringify(player, null, 2), 'utf8');
     console.log('Backup written:', beforePath);
 
-    const plain = '1234';
+    const plain = process.env.PLAYER_PASSWORD || 'defaultpassword';
     const hash = await bcrypt.hash(plain, 10);
     const ok = playerHelpers.update(name, { name, rollerInfo: player.rollerInfo || {}, shopInfo: player.shopInfo || {}, tabInfo: player.tabInfo || {}, pw: '', pwHash: hash });
     if (!ok) {
@@ -31,5 +31,5 @@ const { playerHelpers } = require('../sqlite-db');
     console.log('Updated player:', name, 'pwHash set. After backup:', afterPath);
     console.log(JSON.stringify({ name: updated.name, pwHashPresent: !!updated.pwHash, _id: updated._id }, null, 2));
   }
-  console.log('All done. Password for andreas and chris set to "1234" (hashed).');
+  console.log('All done. Password for andreas and chris set to environment default (hashed).');
 })();