security: remove hardcoded database credentials and auth secrets

- Replace hardcoded DB_PASSWORD 'dwroller2025' with process.env.DB_PASSWORD
- Replace hardcoded GM_SECRET 'bongo' with process.env.GM_SECRET
- Replace hardcoded GM_PASSWORD with process.env.GM_PASSWORD
- Replace hardcoded PLAYER_PASSWORD '1234' with process.env.PLAYER_PASSWORD
- Update .env.example to document required environment variables
- Apply changes to all backend routes, database modules, and React components
- Update test files to use environment variables for credentials
- Ensure .env remains in .gitignore for production safety

This fix addresses critical security vulnerabilities where database
credentials and authentication secrets were exposed in source code.

test-rules.js

@@ -6,7 +6,7 @@ async function testRulesAPI() {
     
     // Test search endpoint
     const searchResponse = await axios.get('http://localhost:5000/api/rules/search?q=combat', {
-      headers: { 'x-gm-secret': 'bongo' }
+      headers: { 'x-gm-secret': process.env.GM_SECRET || 'defaultsecret' }
     });
     
     console.log('Search results:', searchResponse.data);
@@ -14,7 +14,7 @@ async function testRulesAPI() {
     
     // Test stats endpoint
     const statsResponse = await axios.get('http://localhost:5000/api/rules/stats', {
-      headers: { 'x-gm-secret': 'bongo' }
+      headers: { 'x-gm-secret': process.env.GM_SECRET || 'defaultsecret' }
     });
     
     console.log('Stats:', statsResponse.data);